PT-2024-36801 · Unknown · Grist-Core

Spawnzii + 1 · Published 2024-12-20 · Updated 2024-12-20 · CVE-2024-56359

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions grist-core versions prior to 1.3.2

Description The issue arises when a user visits a malicious document and clicks on a link in a HyperLink cell using a control modifier, such as Ctrl+click. This could lead to account compromise, as the link could use the javascript: scheme and be evaluated in the context of their current page.

Recommendations For versions prior to 1.3.2, upgrade to version 1.3.2 or later to resolve the issue. As a temporary workaround for users unable to upgrade, avoid clicking on HyperLink cell links using a control modifier in documents prepared by people they do not trust.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2024-56359

GHSA-QV69-5CJ2-53R9

Affected Products

Grist-Core

References · 8

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/56xxx/CVE-2024-56359.json · Exploit
• https://github.com/gristlabs/grist-core/security/advisories/GHSA-qv69-5cj2-53r9 · Vendor Advisory
• https://github.com/gristlabs/grist-core/commit/a792bdc43b456dbdd6fdc50d8747f4c349fab2f4 · Patch
• https://osv.dev/vulnerability/CVE-2024-56359 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-56359 · Security Note
• https://twitter.com/CVEnew/status/1870207756361138519 · Twitter Post
• https://t.me/cvedetector/13465 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1870231622122954787 · Twitter Post