PT-2024-34372 · Unopim · Unopim

Yamerooo123 · Published 2024-11-06 · Updated 2025-06-24 · CVE-2024-50637

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:N/I:L/A:L

Name of the Vulnerable Software and Affected Versions: UnoPim versions 0.1.3 and below

Description: The issue is related to Cross Site Scripting (XSS) in the Create User function, allowing attackers to perform XSS via an SVG document. This can be used to steal cookies. The vulnerability is exploited through the Create User feature, where an attacker can use an SVG file extension to perform the XSS attack.

Recommendations: For versions 0.1.3 and below, consider disabling the Create User function until a patch is available to prevent exploitation. Restrict access to the Create User feature to minimize the risk of XSS attacks. Avoid using the Create User function with SVG file extensions until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2024-50637

GHSA-HV6M-QJ65-26Q3

Affected Products

Unopim

References · 12

• 🔥 https://github.com/yamerooo123/ResearchNBugBountyEncyclopedia/blob/main/Researches/Unopim/Findings.md · Exploit
• https://github.com/unopim/unopim/issues/41 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-hv6m-qj65-26q3 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-50637 · Security Note
• https://osv.dev/vulnerability/CVE-2024-50637 · Vendor Advisory
• https://github.com/unopim/unopim/releases/tag/v0.1.4 · Note
• https://github.com/unopim/unopim · Note
• https://t.me/cvenotify/100922 · Telegram Post
• https://twitter.com/CVEnew/status/1854203380568068573 · Twitter Post
• https://t.me/cvedetector/10015 · Telegram Post
• https://t.me/cvenotify/126554 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1854309252212388203 · Twitter Post