CVE-2024-55451: XSS
A Stored Cross-Site Scripting (XSS) vulnerability exists in authenticated SVG file upload and viewing functionality in UJCMS 9.6.3. The vulnerability arises from insufficient sanitization of embedded attributes in uploaded SVG files. When a maliciously crafted SVG file is viewed by other backend users, it allows authenticated attackers to execute arbitrary JavaScript in the context of other backend users' browsers, potentially leading to the theft of sensitive tokens.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-55451?
CVE-2024-55451 is classified as a high-severity vulnerability due to its potential for stored XSS attacks.
How do I fix CVE-2024-55451?
To fix CVE-2024-55451, ensure proper sanitization and validation of SVG files during upload to prevent malicious content.
Who is affected by CVE-2024-55451?
CVE-2024-55451 affects versions of UJCMS prior to 9.6.3 that allow authenticated SVG file uploads.
What type of attack does CVE-2024-55451 facilitate?
CVE-2024-55451 facilitates stored cross-site scripting (XSS) attacks through uploaded SVG files.
How can I detect if my system is vulnerable to CVE-2024-55451?
You can detect vulnerability to CVE-2024-55451 by testing if an SVG file with embedded malicious scripts can be uploaded and subsequently executed.