CVE-2024-12870mediumCWE-79

CVE-2024-12870: falha de média gravidade em infiniflow/ragflow

Stored Cross-site Scripting (XSS) in infiniflow/ragflow

Publicada em

Seguir esta CVE+ Monitorar infiniflow/ragflow

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

13Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 5.4epss 0.5%
A stored cross-site scripting (XSS) vulnerability exists in infiniflow/ragflow, affecting the latest commit on the main branch (cec2080). The vulnerability allows an attacker to upload HTML/XML files that can host arbitrary JavaScript payloads. These files are served with the 'application/xml' content type, which is automatically rendered by browsers. This can lead to the execution of arbitrary JavaScript in the context of the user's browser, potentially allowing attackers to steal cookies and gain unauthorized access to user files and resources. The vulnerability does not require authentication, making it accessible to anyone with network access to the instance.
CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Produtos afetados
infiniflow · infiniflow/ragflow
CVEs relacionadas — infiniflow/ragflow

No mesmo produto, das mais perigosas para as menos.

CVE-2024-12433CRITICALRemote Code Execution in infiniflow/ragflowEPSS 1.7%CVE-2024-12450MEDIUMRCE, Full Read SSRF, and Arbitrary File Read in infiniflow/ragflowEPSS 1.3%CVE-2024-10131HIGHRemote Code Execution in infiniflow/ragflowEPSS 1.1%CVE-2024-12880HIGHPartial Account Takeover due to Insecure Data Querying in infiniflow/ragflowEPSS 0.7%CVE-2024-12779MEDIUMSSRF in infiniflow/ragflowEPSS 0.7%CVE-2024-12869MEDIUMImproper Authentication in infiniflow/ragflowEPSS 0.5%