PT-2024-34662 · Cobalt · Cobalt

Dumbmoron · Published 2024-11-04 · Updated 2024-11-05 · CVE-2024-51498

Positive Technologies (AI Summary)

CVSS v4.0

6.0

Medium

Base vector

AV:N/AC:L/AT:P/PR:N/UI:A/VC:L/VI:H/VA:H/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions cobalt versions prior to 10.2.1

Description A malicious cobalt instance could serve links with the javascript: protocol, resulting in Cross-site Scripting (XSS) when the user tries to download an item from a picker. This issue has been present since commit 66bac03e and was mitigated in commit 97977efa for correctly configured web instances.

Recommendations For versions prior to 10.2.1, upgrade to version 10.2.1 or later to fully resolve the issue. For users unable to upgrade, enable a content-security-policy as a temporary mitigation measure.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2024-51498

GHSA-CM4C-V4CM-3735

Affected Products

Cobalt

References · 11

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/51xxx/CVE-2024-51498.json · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2024-51498 · Security Note
• https://osv.dev/vulnerability/CVE-2024-51498 · Vendor Advisory
• https://github.com/imputnet/cobalt/commit/c4be1d3a37b0deb6b6087ec7a815262ac942daf1 · Note
• https://github.com/imputnet/cobalt/commit/97977efabd92375f270d1818f38de3b0682c2f19 · Note
• https://github.com/imputnet/cobalt/security/advisories/GHSA-cm4c-v4cm-3735 · Note
• https://github.com/imputnet/cobalt/commit/66bac03e3078e4e781d2d3903c05ad66a883a354 · Note
• https://twitter.com/VulmonFeeds/status/1853668963852443803 · Twitter Post
• https://twitter.com/CVEnew/status/1853581163715051998 · Twitter Post
• https://t.me/cvenotify/100608 · Telegram Post
• https://t.me/cvedetector/9805 · Telegram Post