CVE-2024-25712: XSS
http-swagger before 1.2.6 allows XSS via PUT requests, because a file that has been uploaded (via httpSwagger.WrapHandler and webdav.memFile) can subsequently be accessed via a GET request. NOTE: this is independently fixable with respect to CVE-2022-24863, because (if a solution continued to allow PUT requests) large files could have been blocked without blocking JavaScript, or JavaScript could have been blocked without blocking large files.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-25712?
CVE-2024-25712 has a medium severity rating due to the potential for XSS through malicious PUT requests.
How do I fix CVE-2024-25712?
To fix CVE-2024-25712, update to http-swagger version 1.2.6 or later.
What impacts does CVE-2024-25712 have on my application?
CVE-2024-25712 may allow attackers to execute arbitrary scripts in the context of a user's session through XSS.
Is CVE-2024-25712 specific to certain versions of http-swagger?
Yes, CVE-2024-25712 affects versions of http-swagger prior to 1.2.6.
What are the conditions for CVE-2024-25712 to be exploited?
CVE-2024-25712 can be exploited if an application allows upload of files via PUT requests without proper validation.