CVE-2024-53274: GHSL-2024-111: Reflected XSS in /home in habitica
Habitica is an open-source habit-building program. Versions prior to 5.28.5 are vulnerable to reflected cross-site scripting. The register function in home.vue containsa reflected XSS vulnerability due to an incorrect sanitization function. An attacker can specify a malicious redirectTo parameter to trigger the vulnerability. Arbitrary javascript can be executed by the attacker in the context of the victim’s session. Version 5.28.5 contains a patch.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2024-53274?
CVE-2024-53274 is classified as a medium severity vulnerability due to the potential for reflected cross-site scripting attacks.
How do I fix CVE-2024-53274?
To fix CVE-2024-53274, upgrade to Habitica version 5.28.5 or later, where the vulnerability has been addressed.
What impact does CVE-2024-53274 have on users?
If exploited, CVE-2024-53274 allows attackers to execute arbitrary scripts in the context of the user's session, potentially compromising user data.
Which versions of Habitica are affected by CVE-2024-53274?
Habitica versions prior to 5.28.5 are affected by CVE-2024-53274.
What component of Habitica is vulnerable in CVE-2024-53274?
CVE-2024-53274 affects the `register` function in the `home.vue` file due to improper sanitization of user input.