CVE-2024-25627CWE-434CWE-79

Cross-Site Scripting (XSS) via File Upload in Alf.io

Low · published February 16, 2024

CVSS v3.1
3.5
EPSS
0%
Percentile
36.2
In the wild
Unconfirmed
What it is

Alf.io is a free and open source event attendance management system. An administrator on the alf.io application is able to upload HTML files that trigger JavaScript payloads. As such, an attacker gaining administrative access to the alf.io application may be able to persist access by planting an XSS payload. This issue has been addressed in version 2.0-M4-2402. Users are advised to upgrade. There are no known workarounds for this vulnerability.

The record
Technical detail
CVSS v3.1
3.5 · LOW
Vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00430 · 36.2th percentile
Weaknesses
CWE-434 · Unrestricted Upload of File with Dangerous Type; CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Published
2024-02-16T20:27Z
EPSS history
Timeline
  • 16 FEB 20:27Z
    Cross-Site Scripting (XSS) via File Upload in Alf.io
    cvelistv5