PT-2024-22497 · Flipsnack · Flipsnack

Gil Correia · Published 2024-04-23 · Updated 2024-07-03 · CVE-2024-28627

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Flipsnack version 18/03/2024

Description An issue in Flipsnack allows a local attacker to obtain sensitive information via the reader.gz.js file.

Recommendations For Flipsnack version 18/03/2024, consider restricting access to the reader.gz.js file as a temporary workaround until a patch is available.

Fix

Incorrect Authorization

Weakness Enumeration

CWE-863

CWE-603

Related Identifiers

CVE-2024-28627

Affected Products

Flipsnack

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2024-28627 · Security Note
• https://twitter.com/VulmonFeeds/status/1782814065724658175 · Twitter Post
• https://t.me/cvenotify/77776 · Telegram Post
• https://t.me/cvenotify/77909 · Telegram Post
• https://labs.integrity.pt/advisories/cve-2024-28627 · Note
• https://flipsnack.com · Note
• https://twitter.com/CVEnew/status/1782765763188666659 · Twitter Post