PT-2025-12352 · Inflectra · Inflectra Spirateam

Published 2025-03-20 · Updated 2025-03-22 · CVE-2024-48591

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Inflectra SpiraTeam version 7.2.00

Description The issue allows a specially crafted SVG file to be uploaded, which can render and execute JavaScript when viewed directly, potentially leading to Cross Site Scripting (XSS) attacks.

Recommendations For Inflectra SpiraTeam version 7.2.00, consider restricting the upload of SVG files or disabling the rendering of JavaScript from uploaded files until a fix is available. As a temporary workaround, avoid directly viewing uploaded SVG files to minimize the risk of exploitation.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2024-48591

Affected Products

Inflectra Spirateam

References · 6

• 🔥 https://github.com/GCatt-AS/CVE-2024-48591 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2024-48591 · Security Note
• https://osv.dev/vulnerability/CVE-2024-48591 · Vendor Advisory
• https://twitter.com/CVEnew/status/1903336863315661096 · Twitter Post
• https://t.me/cvedetector/20739 · Telegram Post
• https://t.me/cvetracker/19546 · Telegram Post