CVE-2024-55416

LOW
2025-01-30 [email protected]
3.5
CVSS 3.1

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:N
Attack Vector
Network
Attack Complexity
Low
Privileges Required
High
User Interaction
Required
Scope
Unchanged
Confidentiality
Low
Integrity
Low
Availability
None

Lifecycle Timeline

3
Analysis Generated
Mar 28, 2026 - 18:06 vuln.today
PoC Detected
May 23, 2025 - 16:31 vuln.today
Public exploit code
CVE Published
Jan 30, 2025 - 15:15 nvd
LOW 3.5

Tags

XSS Voyager

Description

DevDojo Voyager through version 1.8.0 is vulnerable to reflected XSS via /admin/compass. By manipulating an authenticated user to click on a link, arbitrary Javascript can be executed.

Analysis

DevDojo Voyager through version 1.8.0 is vulnerable to reflected XSS via /admin/compass. Rated low severity (CVSS 3.5), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.

Technical Context

This vulnerability is classified as Cross-Site Scripting (XSS) (CWE-79), which allows attackers to inject malicious scripts into web pages viewed by other users. DevDojo Voyager through version 1.8.0 is vulnerable to reflected XSS via /admin/compass. By manipulating an authenticated user to click on a link, arbitrary Javascript can be executed. Affected products include: Thecontrolgroup Voyager. Version information: version 1.8.0.

Affected Products

Thecontrolgroup Voyager.

Remediation

No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Sanitize all user input, use Content-Security-Policy headers, encode output contextually (HTML, JS, URL). Use frameworks with built-in XSS protection.

Priority Score

39
Low Medium High Critical
KEV: 0
EPSS: +1.3
CVSS: +18
POC: +20

Share

CVE-2024-55416 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy