CVE-2024-4023: Stored XSS in flatpressblog/flatpress
A stored cross-site scripting (XSS) vulnerability exists in flatpressblog/flatpress version 1.3. When a user uploads a file with a .xsig extension and directly accesses this file, the server responds with a Content-type of application/octet-stream, leading to the file being processed as an HTML file. This allows an attacker to execute arbitrary JavaScript code, which can be used to steal user cookies, perform HTTP requests, and access content of the same origin.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2024-4023?
CVE-2024-4023 is classified as a medium severity vulnerability due to its potential for stored cross-site scripting (XSS) attacks.
How do I fix CVE-2024-4023?
To fix CVE-2024-4023, ensure that your FlatPress installation is updated to the latest version that addresses this vulnerability.
What versions of FlatPress are affected by CVE-2024-4023?
FlatPress version 1.3 is affected by CVE-2024-4023, which allows for stored XSS vulnerabilities when handling `.xsig` files.
Can CVE-2024-4023 be exploited remotely?
Yes, CVE-2024-4023 can be exploited remotely by an attacker who uploads a malicious `.xsig` file and accesses it directly.
What is stored cross-site scripting in relation to CVE-2024-4023?
Stored cross-site scripting, as seen in CVE-2024-4023, occurs when an attacker successfully injects malicious scripts that are stored on the server and executed later by unsuspecting users.