CVE-2024-52597: medium-severity vulnerability in Bubka 2FAuth
2FAuth vulnerable to stored cross-site scripting via SVG upload and direct access render
Published
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
13Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 6.1epss 0.4%
2FAuth is a web app to manage Two-Factor Authentication (2FA) accounts and generate their security codes. Versions prior to 5.4.1 are vulnerable to stored cross-site scripting due to improper headers in direct access to uploaded SVGs. The application allows uploading images in several places. One of the accepted types of image is SVG, which allows JS scripting. Therefore, by uploading a malicious SVG which contains JS code, an attacker which is able to drive a victim to the uploaded image could compromise that victim's session and access to their tokens. Version 5.4.1 contains a patch for the issue.
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Affected products
Bubka · 2FAuthRelated CVEs — Bubka 2FAuth
In the same product, most dangerous first.
CVE-2024-52598HIGH2FAuth vulnerable to Server Side Request Forgery + URI validation bypass in 2fauth /api/v1/twofaccounts/previewEPSS 0.6%CVE-2026-32133HIGH2FAuth has Blind SSRF in image parameter allows internal network access and moreEPSS 0.5%CVE-2023-36816MEDIUMCross-Site Scripting (XSS) at Account creation in 2FAuthEPSS 0.5%