CVE-2024-4337 is a High (CVSS 7.6) persistent cross site scripting flaw in Adive Framework 2.0.8, through multiple parameters of /adive/admin/nav/add. The record says an attacker can retrieve an authenticated user's session details. It names no fix, so reduce exposure and check the INCIBE notice.
What's affected
- Product: Adive Framework 2.0.8.
- Affected page: /adive/admin/nav/add, the page for adding navigation items, via multiple parameters.
- Fixed version: none on record, and the INCIBE notice was blocked for me.
- Severity: High, CVSS 7.6, with user interaction needed.
- Impact in the record: theft of session details of a logged in user.
- Exploitation: KEV is false.
- Navigation items appear on public pages, which is worth checking, as I explain below.
How to check if you're exposed
Navigation entries often render on every page of a site, not only the admin area. If a stored value contains script, it could run for every visitor. Review your navigation records for angle brackets, script tags or on-event attributes.
Confirm the framework version in your project files. 2.0.8 matches the record.
What to do now
- Review navigation items in the database and the admin screen for script content.
- Confirm whether the navigation renders on public pages and, if so, treat every visitor as in scope.
- Restrict the admin area and use unique, strong credentials.
- Apply a Content Security Policy and HttpOnly cookies.
- Follow the INCIBE notice and the project for a fixed release.
Why it matters
The record maps this to CWE-79. Input to the navigation form is stored and later written into HTML without encoding. The browser cannot tell trusted markup from the stored text.
Where output encoding is missing in one form, it is often missing in others. Two Adive records name two pages, and a code review of the rest of the admin area is a reasonable next step.
Quick check
Can this affect public visitors?
Navigation items usually appear on public pages, so a stored script could run for them as well. The record only describes theft of an authenticated user's session, so confirm in your own setup.
Is there a fix?
The record names none. Check with the project.
Scan your own dependencies
Safeguard's free in-browser dependency scan at gold.safeguard.sh/scan checks a manifest against known advisories, and the Gold directory keeps this record's details in one place.
Sources
The NVD record for CVE-2024-4337 (published 2024-04-30) supplied the description, score and weakness data. Pages marked fetched were read for this post. The others are listed in the record and were not read.
Last reviewed: 19 October 2026.
