CVE-2024-10099mediumCWE-79

CVE-2024-10099: fallo de gravedad media en comfyanonymous/comfyui

Stored XSS in comfyanonymous/comfyui

Publicada el

Seguir esta CVE+ Monitorear comfyanonymous/comfyui

Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.

13Vexday Risk Score

Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.

ssvc Trackcvss 6.1epss 0.4%
A stored cross-site scripting (XSS) vulnerability exists in comfyanonymous/comfyui version 0.2.2 and possibly earlier. The vulnerability occurs when an attacker uploads an HTML file containing a malicious XSS payload via the `/api/upload/image` endpoint. The payload is executed when the file is viewed through the `/view` API endpoint, leading to potential execution of arbitrary JavaScript code.
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Productos afectados
comfyanonymous · comfyanonymous/comfyui
CVEs relacionadas — comfyanonymous/comfyui

En el mismo producto, de las más peligrosas a las menos.

CVE-2024-12882HIGHSSRF in comfyanonymous/comfyuiEPSS 0.8%CVE-2024-10481MEDIUMCross-Site Request Forgery (CSRF) in comfyanonymous/comfyuiEPSS 0.2%