PT-2024-37468 · Quivr · Quivr

Published 2024-07-07 · Updated 2024-07-11 · CVE-2024-6229

Positive Technologies (AI Summary)

CVSS v3.1

6.8

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions: stangirard/quivr version latest

Description: A stored cross-site scripting (XSS) vulnerability exists in the 'Upload Knowledge' feature. Users can upload files via URL, which allows the insertion of malicious JavaScript payloads. These payloads are stored on the server and executed whenever any user clicks on a link containing the payload, leading to potential data theft, session hijacking, and reputation damage.

Recommendations: For the latest version, consider disabling the 'Upload Knowledge' feature until a patch is available to prevent the insertion of malicious JavaScript payloads. Restrict access to the feature to minimize the risk of exploitation. Avoid using the 'Upload Knowledge' feature via URL until the issue is resolved.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2024-6229

Affected Products

Quivr

References · 7

• 🔥 https://huntr.com/bounties/2ee71e9e-2cf5-41a4-8440-d75758018786 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2024-6229 · Security Note
• https://osv.dev/vulnerability/CVE-2024-6229 · Vendor Advisory
• https://twitter.com/VulmonFeeds/status/1810026491062739087 · Twitter Post
• https://t.me/cvedetector/164 · Telegram Post
• https://twitter.com/CVEnew/status/1809972638858555559 · Twitter Post
• https://t.me/cvenotify/85318 · Telegram Post