CVE-2024-51498: [@imput/cobalt-web] Cross-site Scripting when downloading picker image from malicious instance
cobalt is a media downloader that doesn't piss you off. A malicious cobalt instance could serve links with the javascript: protocol, resulting in Cross-site Scripting (XSS) when the user tries to download an item from a picker. This issue has been present since commit 66bac03e, was mitigated in commit 97977efa (correctly configured web instances were no longer vulnerable) and fully fixed in commit c4be1d3a (included in release version 10.2.1). Users are advised to upgrade. Users unable to upgrade should enable a content-security-policy.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-51498?
CVE-2024-51498 has been classified as a moderate severity vulnerability due to its potential for Cross-site Scripting (XSS).
How do I fix CVE-2024-51498?
To fix CVE-2024-51498, upgrade to a version of Cobalt newer than 10.2.1 to avoid the vulnerabilities associated with JavaScript links in the media downloader.
What are the risks associated with CVE-2024-51498?
The risks associated with CVE-2024-51498 include potential execution of malicious scripts leading to unauthorized access or manipulation of user data.
Which versions of Cobalt are affected by CVE-2024-51498?
CVE-2024-51498 affects Cobalt versions prior to 10.2.1, specifically starting from version 10.2.1.
What type of vulnerability is CVE-2024-51498?
CVE-2024-51498 is a Cross-site Scripting (XSS) vulnerability that allows execution of arbitrary JavaScript code through malicious links.