PT-2024-21084 · Viewerjs · Viewerjs

Alexis Pain · Published 2024-05-01 · Updated 2024-10-29 · CVE-2024-25676

Positive Technologies (AI Summary)

CVSS v3.1

4.7

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions ViewerJS version 0.5.8

Description An issue was discovered in ViewerJS where a script from the component loads content via URL TAGs without properly sanitizing it, leading to both open redirection and out-of-band resource loading.

Recommendations For ViewerJS version 0.5.8, consider disabling the script that loads content via URL TAGs until a patch is available. Restrict access to the component to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Open Redirect

Weakness Enumeration

CWE-601

Related Identifiers

CVE-2024-25676

Affected Products

Viewerjs

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2024-25676 · Security Note
• https://twitter.com/CVEnew/status/1785749756293300626 · Twitter Post
• https://t.me/cvenotify/78818 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1785804186463981933 · Twitter Post
• https://t.me/cvenotify/99923 · Telegram Post
• https://cds.thalesgroup.com/en/tcs-cert/CVE-2024-25676 · Note
• https://excellium-services.com/cert-xlm-advisory/cve-2024-25676 · Note