CVE-2024-44777

Name of the Vulnerable Software and Affected Versions vTiger CRM version 7.4.0

Description A reflected cross-site scripting (XSS) vulnerability in the tag parameter in the index page of vTiger CRM allows attackers to execute arbitrary code in the context of a user's browser via injecting a crafted payload. The vulnerability is exploited through the index page, specifically targeting the tag parameter.

Recommendations For vTiger CRM version 7.4.0, as a temporary workaround, consider restricting access to the index page or disabling the tag parameter to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.