CVE-2024-37675 describes a Cross Site Scripting (CWE-79) vulnerability in Tessi Docubase Document Management product 5.x. The vulnerability is triggered via the 'sectionContent' parameter related to the functionality for adding notes to uploaded files. An attacker with low privileges can remotely exploit this vulnerability by convincing a user to interact with crafted content, potentially leading to execution of arbitrary code within the victim's browser session. The CVSS v3.1 base score is 5.4, reflecting network attack vector, low attack complexity, required privileges, user interaction, and partial impact on confidentiality and integrity. No patch or official remediation level has been disclosed as of the publication date.

Successful exploitation allows remote attackers to execute arbitrary code in the context of the victim's browser session by injecting malicious scripts via the 'sectionContent' parameter. This can lead to partial compromise of confidentiality and integrity of data accessible through the application. Availability is not impacted. The attack requires user interaction and low privileges, limiting the scope but still posing a significant risk to users of the affected product.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should exercise caution when interacting with untrusted content in the note-adding functionality of Tessi Docubase Document Management product 5.x. Consider applying web application firewall (WAF) rules to detect and block XSS payloads targeting the 'sectionContent' parameter if feasible.