CVE-2024-48591

Name of the Vulnerable Software and Affected Versions Inflectra SpiraTeam version 7.2.00

Description The issue allows a specially crafted SVG file to be uploaded, which can render and execute JavaScript when viewed directly, potentially leading to Cross Site Scripting (XSS) attacks.

Recommendations For Inflectra SpiraTeam version 7.2.00, consider restricting the upload of SVG files or disabling the rendering of JavaScript from uploaded files until a fix is available. As a temporary workaround, avoid directly viewing uploaded SVG files to minimize the risk of exploitation.