PT-2025-3102

CVE-2024-55224

Published

2025-01-09

Updated

2025-01-10

Description by

CVSS 3.1

9.6

Critical

MetricsAV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Vaultwarden versions prior to 1.32.5

Description The issue allows attackers to execute arbitrary code via injecting a crafted payload into the username field of an e-mail message. This is an HTML injection vulnerability.

Recommendations For versions prior to 1.32.5, update to version 1.32.5 or later to resolve the issue. As a temporary workaround, consider restricting the use of the username field in e-mail messages until a patch is applied.

Exploitability

Exploit

Fix

Impacts

Researchers

Nils Emmerich

Vendors

Affected products

Weakness enumeration

CWE-79: Improper Neutralization of Input During Web Page Generation (\'Cross-site Scripting\')

Related identifiers

CVE-2024-55224