TI-2024-27757 Aliases CVE-2024-41697 GHSA-f8w7-phwr-8g55

Priority – CWE-80: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)

LOW 27CWE-80Published 2024-08-20 · Updated 2024-08-20

Key facts

Attack vector: Network
Privileges required: None
User interaction: Required
Attack complexity: Low
Impact type: Cross-site scripting
Confidentiality · integrity · availability: Low · Low · None
Fix status: Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-80.

Summary

Priority - CWE-80: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00269 19th percentileScored 2026-11-07

Fix Fixed Priority (Priority): Upgrade to version 24.0 or later

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Priority	Priority	All versions to before Upgrade to version 24.0 or later	Upgrade to version 24.0 or later	Patch available	CNA

Priority VendorPriority Affected All versions to before Upgrade to version 24.0 or later Fixed in Upgrade to version 24.0 or later Patch available CNA

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:priority-software:priority::::::::	before 24.0	Vulnerable	Priority

cpe:2.3:a:priority-software:priority:*:*:*:*:*:*:*:* Versions before 24.0 Vulnerable ·Priority

Remediation

Fix · CNA Priority (Priority) Fixed in Upgrade to version 24.0 or later

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

Release · 2024-08-20
Priority Upgrade to version 24.0 or later
3 records Highest priority Priority LOW 3 LOW
Other records, highest priority first
- TI-2024-27759 Priority – CWE-552: Files or Directories Accessible to External PartiesPriority LOW 33
- TI-2024-27758 Priority – CWE-200: Exposure of Sensitive Information to an Unauthorized ActorPriority LOW 33
Show all 3 records →

Timeline

2026-10-02 Threatist record created from CVE-2024-41697
2026-10-03 Alias added: GHSA-f8w7-phwr-8g55

References

Advisory 1

https://www.gov.il/en/Departments/faq/cve_advisories

TI-2023-09302 Priority Web – Authentication bypass CVSS 3.1CRITICAL 9.8
TI-2023-09301 Priority Windows – Command Execution via SQL Injection CVSS 3.1CRITICAL 9.8
TI-2024-27759 Priority – CWE-552: Files or Directories Accessible to External Parties CVSS 3.1HIGH 7.5
TI-2024-27758 Priority – CWE-200: Exposure of Sensitive Information to an Unauthorized Actor CVSS 3.1HIGH 7.5
TI-2022-07329 Priority - Priority web Insecure direct object references (IDOR) CVSS 3.1MEDIUM 6.3
TI-2022-07328 Priority - Priority User Enumeration CVSS 3.1MEDIUM 5.5

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences