CVE-2024-12871: falha de média gravidade em infiniflow/ragflow
Stored Cross-site Scripting (XSS) in infiniflow/ragflow
Publicada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
13Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 5.4epss 0.4%
An XSS vulnerability in infiniflow/ragflow version 0.12.0 allows an attacker to upload a malicious PDF file to the knowledge base. When the file is viewed within Ragflow, the payload is executed in the context of the user's browser. This can lead to session hijacking, data exfiltration, or unauthorized actions performed on behalf of the victim, compromising sensitive user data and affecting the integrity of the entire application.
CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Produtos afetados
infiniflow · infiniflow/ragflowCVEs relacionadas — infiniflow/ragflow
No mesmo produto, das mais perigosas para as menos.
CVE-2024-12433CRITICALRemote Code Execution in infiniflow/ragflowEPSS 1.7%CVE-2024-12450MEDIUMRCE, Full Read SSRF, and Arbitrary File Read in infiniflow/ragflowEPSS 1.3%CVE-2024-10131HIGHRemote Code Execution in infiniflow/ragflowEPSS 1.1%CVE-2024-12880HIGHPartial Account Takeover due to Insecure Data Querying in infiniflow/ragflowEPSS 0.7%CVE-2024-12779MEDIUMSSRF in infiniflow/ragflowEPSS 0.7%CVE-2024-12869MEDIUMImproper Authentication in infiniflow/ragflowEPSS 0.5%