CVE-2024-11824: Stored XSS in langgenius/dify
A stored cross-site scripting (XSS) vulnerability exists in langgenius/dify version latest, specifically in the chat log functionality. The vulnerability arises because certain HTML tags like <input> and <form> are not disallowed, allowing an attacker to inject malicious HTML into the log via prompts. When an admin views the log containing the malicious HTML, the attacker could steal the admin's credentials or sensitive information. This issue is fixed in version 0.12.1.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
langgenius/difyto a version that resolves this vulnerability.Fixed in 0.12.1
Event History
Frequently Asked Questions
What is the severity of CVE-2024-11824?
CVE-2024-11824 is classified as a moderate severity stored cross-site scripting (XSS) vulnerability.
How do I fix CVE-2024-11824?
To fix CVE-2024-11824, update langgenius/dify to at least version 0.12.1 where the vulnerability has been addressed.
What software is affected by CVE-2024-11824?
CVE-2024-11824 affects langgenius/dify versions up to 0.12.1.
What type of vulnerability is CVE-2024-11824?
CVE-2024-11824 is a stored cross-site scripting (XSS) vulnerability in the chat log functionality.
What can attackers achieve with CVE-2024-11824?
Attackers can inject malicious HTML into the chat log, potentially leading to unauthorized actions or data exposure for users.