CVE-2024-33326

Name of the Vulnerable Software and Affected Versions Lumisxp versions 15.0.x through 16.1.x

Description A cross-site scripting (XSS) issue in the XsltResultControllerHtml.jsp component allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the lumPageID parameter.

Recommendations For Lumisxp versions 15.0.x through 16.1.x, consider restricting access to the XsltResultControllerHtml.jsp component until a patch is available. As a temporary workaround, avoid using the lumPageID parameter in the affected component to minimize the risk of exploitation.