PT-2025-2027 · Unknown · Osuuu Lightpicture

Jiashenghe · Published 2025-01-05 · Updated 2025-01-10 · CVE-2024-13141

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions osuuu LightPicture versions 1.2.2 and earlier

Description A problematic vulnerability was found in osuuu LightPicture, affecting unknown code of the file "/api/upload" of the component SVG File Upload Handler. The manipulation of the argument file leads to cross-site scripting attacks. These attacks can be initiated remotely.

Recommendations For versions 1.2.2 and earlier, as a temporary workaround, consider disabling the "/api/upload" endpoint until a patch is available. Restrict access to the SVG File Upload Handler component to minimize the risk of exploitation. Avoid using the argument file in the affected API endpoint until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

XSS

Code Injection

Weakness Enumeration

CWE-79

CWE-94

Related Identifiers

CVE-2024-13141

Affected Products

Osuuu Lightpicture

References · 12

• 🔥 https://github.com/Hebing123/cve/issues/83 · Exploit
• https://osv.dev/vulnerability/CVE-2024-13141 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-13141 · Security Note
• https://t.me/cvedetector/14304 · Telegram Post
• https://t.me/cvenotify/106344 · Telegram Post
• https://twitter.com/CVEnew/status/1875917764449239347 · Twitter Post
• https://twitter.com/CVETracker/status/1876029963842818337 · Twitter Post
• https://vuldb.com/?submit.468645 · Note
• https://twitter.com/VulmonFeeds/status/1875932424032415913 · Twitter Post
• https://vuldb.com/?ctiid.290224 · Note
• https://t.me/cvenotify/107115 · Telegram Post
• https://vuldb.com/?id.290224 · Note