StableN/ASyncedN/A

CVE-2024-6200 - Stored Cross-Site Scripting in Tickets

Updated Sep 25, 20261,768 viewsView on usehalo.com
  • security
  • vulnerability
  • cve

General Information

This article contains frequently asked questions relating to the store cross-site scripting vulnerability affecting Halo versions up to 2.143.6.
Users with the permission to open tickets may embed malicious JavaScript code into them, that, when accessed by another user, executes within the context of that user.

Are hosted Halo instances affected?

Hosted customers have been automatically updated to a patch to resolve this issue, and therefore no action is required by hosted customers. The patch was released on 2024-03-06 and hosted customers were upgraded shortly afterwards.

Are On-Prem Halo instances affected?

Halo On-Prem installations should apply the latest stable or beta patch to their Halo instance to resolve this issue.

  • Any version >= 2.143.6

Next Steps

No action is required on the part of our customers.

We will continue to monitor our business infrastructure to ensure the same level of service and security that you expect.

Links