CVE-2024-11623CWE-79

Stored XSS in authentik

Medium · published February 4, 2025

CVSS v4.0
4.8
EPSS
0%
Percentile
21.2
In the wild
Unconfirmed
What it is

Authentik project is vulnerable to Stored XSS attacks through uploading crafted SVG files that are used as application icons.

This action could only be performed by an authenticated admin user.

The issue was fixed in 2024.10.4 release.

The record
Technical detail
CVSS v4.0
4.8 · MEDIUM
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N
EPSS
0.00297 · 21.2th percentile
Weakness
CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Published
2025-02-04T13:34Z
EPSS history
Timeline
  • 04 FEB 13:34Z
    Stored XSS in authentik
    cvelistv5