CVE-2024-25807: XSS
Published Mar 22, 2024
·Updated
Cross Site Scripting (XSS) vulnerability in Lychee 3.1.6, allows remote attackers to execute arbitrary code and obtain sensitive information via the title parameter when creating an album.
Affected Software
2 affected components
Lycheeorg Lychee=3.1.6
Lychee Lychee
Event History
Mar 22, 2024
CVE Published
via MITRE·12:00 AM
Data Sourced
via MITRE·12:00 AM
Description
Data Sourced
via NVD·03:15 AM
DescriptionSeverityWeakness
Frequently Asked Questions
1
What is the severity of CVE-2024-25807?
CVE-2024-25807 is classified as a high-severity cross-site scripting (XSS) vulnerability.
2
How do I fix CVE-2024-25807?
To fix CVE-2024-25807, update to a patched version of Lychee that addresses the XSS vulnerability.
3
Who is affected by CVE-2024-25807?
CVE-2024-25807 affects users of Lychee version 3.1.6.
4
What kind of attack can CVE-2024-25807 facilitate?
CVE-2024-25807 can facilitate remote code execution and access to sensitive information through crafted album title parameters.
5
When was CVE-2024-25807 discovered?
CVE-2024-25807 was reported for Lychee version 3.1.6.