Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) (CWE-80)
A reflected XSS vulnerability exists in the handling of invalid paths in the Flask server in Ankitects Anki 24.04. A specially crafted flashcard can lead to JavaScript code execution and result in an arbitrary file read. An attacker can share a malicious flashcard to trigger this vulnerability.
This vulnerability allows an attacker to execute arbitrary JavaScript code in the context of the victim's browser. The attacker can potentially read arbitrary files on the victim's system, leading to a breach of confidentiality. The CVSS v3.1 base score is 8.2 (High), with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N. This indicates a high confidentiality impact and a low integrity impact, but no direct impact on availability. The attack vector is network-based, requires low complexity, no privileges, and user interaction.
One proof-of-concept exploit is available on talosintelligence.com. There is no evidence of proof of exploitation at the moment.
A patch is not explicitly mentioned in the provided information. However, given that the vulnerability is specific to Ankitects Anki version 24.04, it's likely that upgrading to a newer version (if available) would address this issue.
1. Update Ankitects Anki to a version newer than 24.04 if available. 2. Implement strong input validation and sanitization for all user-supplied content, especially in flashcards. 3. Use Content Security Policy (CSP) headers to restrict the execution of scripts. 4. Educate users about the risks of importing flashcards from untrusted sources. 5. Consider implementing a sandbox environment for viewing shared or imported flashcards.
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N
NVD published the first details for CVE-2024-32484
A CVSS base score of 7.4 has been assigned.
Feedly found the first article mentioning CVE-2024-32484. See article
Feedly estimated the CVSS score as MEDIUM
This CVE started to trend in security discussions
EPSS Score was set to: 0.09% (Percentile: 37.5%)
The vulnerability CVE-2024-32484 in the web-server allows for arbitrary file read and XSS attacks, posing a critical risk to the system's security. It has been exploited in the wild by threat actors, with proof-of-concept exploits available. Mitigations include implementing input validation and applying patches provided by the vendor. Downstream impacts may affect third-party vendors relying on the vulnerable technology. See article
This CVE stopped trending in security discussions
A CVSS base score of 8.2 has been assigned.