PT-2024-21047 · Alf.Io · Alf.Io

Pinkdraconian · Published 2024-02-16 · Updated 2024-12-18 · CVE-2024-25627

Positive Technologies (AI Summary)

CVSS v3.1

4.8

Medium

Base vector

AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Alf.io versions prior to 2.0-M4-2402

Description The issue allows an administrator on the Alf.io application to upload HTML files that trigger JavaScript payloads. This could enable an attacker who gains administrative access to persist access by planting an XSS payload. There are no known workarounds for this issue.

Recommendations For versions prior to 2.0-M4-2402, upgrade to version 2.0-M4-2402 or later to resolve the issue. As a temporary workaround, consider restricting access to the HTML file upload feature until a patch is applied.

Exploit

Fix

XSS

Unrestricted File Upload

Weakness Enumeration

CWE-79

CWE-434

Related Identifiers

CVE-2024-25627

GHSA-GPMG-8F92-37CF

Affected Products

Alf.Io

References · 6

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/25xxx/CVE-2024-25627.json · Exploit
• 🔥 https://github.com/alfio-event/alf.io/security/advisories/GHSA-gpmg-8f92-37cf · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2024-25627 · Security Note
• https://osv.dev/vulnerability/CVE-2024-25627 · Vendor Advisory
• https://twitter.com/VulmonFeeds/status/1758636717152858328 · Twitter Post
• https://twitter.com/CVEnew/status/1758591573338763491 · Twitter Post