PT-2024-21047

CVE-2024-25627

Published

2024-02-16

Updated

2024-12-18

Description by

CVSS 3.1

4.8

Medium

MetricsAV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Alf.io versions prior to 2.0-M4-2402

Description The issue allows an administrator on the Alf.io application to upload HTML files that trigger JavaScript payloads. This could enable an attacker who gains administrative access to persist access by planting an XSS payload. There are no known workarounds for this issue.

Recommendations For versions prior to 2.0-M4-2402, upgrade to version 2.0-M4-2402 or later to resolve the issue. As a temporary workaround, consider restricting access to the HTML file upload feature until a patch is applied.

Exploitability

Exploit

Fix

Impacts

Researchers

Pinkdraconian

Vendors

Affected products

Weakness enumeration

CWE-79: Improper Neutralization of Input During Web Page Generation (\'Cross-site Scripting\')

CWE-434: Unrestricted Upload of File with Dangerous Type

Related identifiers