{"action":"Upgrade passbolt/passbolt_api to 4.6.2 or later.","affected":[{"fixed":"4.6.2","introduced":"0"}],"component":"passbolt/passbolt_api","cve_ids":["CVE-2024-33670"],"ecosystem":"Packagist","epss":0.00482,"exploited":false,"fixed_versions":["4.6.2"],"ghsa_id":"GHSA-2pg6-vw9c-qhjv","id":"tcs_01M5KES4GE64Z8YQDQF8W0YE62","modified_at":"2024-04-26T17:12:07.240684Z","published_at":"2024-04-26T03:30:29Z","references":["https://osv.dev/vulnerability/GHSA-2pg6-vw9c-qhjv","https://nvd.nist.gov/vuln/detail/CVE-2024-33670","https://github.com/passbolt/passbolt_api/commit/5c537849040990086dcd5013b5bb009e1dad3fb6","https://help.passbolt.com/incidents/reflective-html-injection-vulnerability"],"severity":{"label":"medium","score":4.3},"sources":[{"source":"osv","source_id":"GHSA-2pg6-vw9c-qhjv","url":"https://osv.dev/vulnerability/GHSA-2pg6-vw9c-qhjv"}],"summary":"Passbolt API allows HTML injection"}