PT-2024-28738 · Unknown · Vaultwarden

Mirko Richter + 1 · Published 2024-09-13 · Updated 2025-07-10 · CVE-2024-39926

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Vaultwarden (formerly Bitwarden RS) version 1.30.3

Description A stored cross-site scripting (XSS) or HTML injection issue has been discovered in the admin dashboard. This potentially allows an authenticated attacker to inject malicious code into the dashboard, which is then executed or rendered in the context of an administrator's browser when viewing the injected content. The default Content Security Policy (CSP) of the application blocks most exploitation paths, significantly mitigating the potential impact.

Recommendations For version 1.30.3, consider disabling access to the admin dashboard until a patch is available to prevent potential exploitation. Restrict the use of the vulnerable component in the admin dashboard to minimize the risk of malicious code injection.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2024-39926

Affected Products

Vaultwarden

References · 9

• 🔥 https://mgm-sp.com/cve/html-injection-in-vaultwarden · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2024-39926 · Security Note
• https://osv.dev/vulnerability/CVE-2024-39926 · Vendor Advisory
• https://github.com/dani-garcia/vaultwarden/releases/tag/1.32.0 · Note
• https://github.com/dani-garcia/vaultwarden/blob/1.30.3/src/static/scripts/admin_users.js#L201 · Note
• https://t.me/cvenotify/128328 · Telegram Post
• https://t.me/cvedetector/5644 · Telegram Post
• https://twitter.com/CVEnew/status/1834648955050934629 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1834696386048106738 · Twitter Post