PT-2024-34154 · I · I

Alessio-Romano + 1 · Published 2024-10-30 · Updated 2025-10-01 · CVE-2024-50344

Positive Technologies (AI Summary)

CVSS v3.1

4.6

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions: I, Librarian versions prior to 5.11.2

Description: The issue arises from a broken logic in handling Supplemental Files, allowing unsafe files with Javascript to be executed within the application context. An attacker can exploit this by uploading a malicious file, which will be executed when loaded in the browser.

Recommendations: For versions prior to 5.11.2, update to version 5.11.2 to resolve the issue. As a temporary workaround, consider restricting the upload of supplementary files or disabling the viewing of such files in the browser until the update is applied.

Exploit

Fix

XSS

Weakness Enumeration

CWE-80

Related Identifiers

CVE-2024-50344

GHSA-C2RM-W62W-5XMJ

Affected Products

I

References · 7

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/50xxx/CVE-2024-50344.json · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2024-50344 · Security Note
• https://osv.dev/vulnerability/CVE-2024-50344 · Vendor Advisory
• https://github.com/mkucej/i-librarian-free/commit/a67d7949ffb02fd912ebdcf552df006b44066d78 · Note
• https://github.com/mkucej/i-librarian-free/security/advisories/GHSA-c2rm-w62w-5xmj · Note
• https://twitter.com/dailycve/status/1973510612090233338 · Twitter Post
• https://t.me/cvedetector/9439 · Telegram Post