PT-2024-36800 · Unknown · Grist-Core

Vviers · Published 2024-12-20 · Updated 2024-12-20 · CVE-2024-56358

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions grist-core versions prior to 1.3.2

Description The issue concerns a spreadsheet hosting server where a user's account could be compromised by visiting a malicious document and previewing an attachment. This happens because JavaScript in an SVG file is evaluated in the context of the user's current page, allowing for potential account takeover.

Recommendations For versions prior to 1.3.2, upgrade to version 1.3.2 or later to resolve the issue. As a temporary workaround for users unable to upgrade, avoid previewing attachments in documents prepared by untrusted individuals.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2024-56358

GHSA-JVFM-GF4F-33Q3

Affected Products

Grist-Core

References · 8

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/56xxx/CVE-2024-56358.json · Exploit
• https://github.com/gristlabs/grist-core/security/advisories/GHSA-jvfm-gf4f-33q3 · Vendor Advisory
• https://github.com/gristlabs/grist-core/commit/a792bdc43b456dbdd6fdc50d8747f4c349fab2f4 · Patch
• https://osv.dev/vulnerability/CVE-2024-56358 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-56358 · Security Note
• https://t.me/cvedetector/13462 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1870234182321885447 · Twitter Post
• https://twitter.com/CVEnew/status/1870207757611155826 · Twitter Post