CVE-2024-12870mediumCWE-79

CVE-2024-12870: fallo de gravedad media en infiniflow/ragflow

Stored Cross-site Scripting (XSS) in infiniflow/ragflow

Publicada el

Seguir esta CVE+ Monitorear infiniflow/ragflow

Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.

13Vexday Risk Score

Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.

ssvc Trackcvss 5.4epss 0.5%
A stored cross-site scripting (XSS) vulnerability exists in infiniflow/ragflow, affecting the latest commit on the main branch (cec2080). The vulnerability allows an attacker to upload HTML/XML files that can host arbitrary JavaScript payloads. These files are served with the 'application/xml' content type, which is automatically rendered by browsers. This can lead to the execution of arbitrary JavaScript in the context of the user's browser, potentially allowing attackers to steal cookies and gain unauthorized access to user files and resources. The vulnerability does not require authentication, making it accessible to anyone with network access to the instance.
CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Productos afectados
infiniflow · infiniflow/ragflow
CVEs relacionadas — infiniflow/ragflow

En el mismo producto, de las más peligrosas a las menos.

CVE-2024-12433CRITICALRemote Code Execution in infiniflow/ragflowEPSS 1.7%CVE-2024-12450MEDIUMRCE, Full Read SSRF, and Arbitrary File Read in infiniflow/ragflowEPSS 1.3%CVE-2024-10131HIGHRemote Code Execution in infiniflow/ragflowEPSS 1.1%CVE-2024-12880HIGHPartial Account Takeover due to Insecure Data Querying in infiniflow/ragflowEPSS 0.7%CVE-2024-12779MEDIUMSSRF in infiniflow/ragflowEPSS 0.7%CVE-2024-12869MEDIUMImproper Authentication in infiniflow/ragflowEPSS 0.5%