CVE-2024-6229: Stored XSS in stangirard/quivr
A stored cross-site scripting (XSS) vulnerability exists in the 'Upload Knowledge' feature of stangirard/quivr, affecting the latest version. Users can upload files via URL, which allows the insertion of malicious JavaScript payloads. These payloads are stored on the server and executed whenever any user clicks on a link containing the payload, leading to potential data theft, session hijacking, and reputation damage.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-6229?
CVE-2024-6229 is rated as a high severity vulnerability due to its potential to execute malicious scripts on affected servers.
How do I fix CVE-2024-6229?
To fix CVE-2024-6229, update to a version of Quivr that is newer than 0.0.281, which addresses the stored XSS vulnerability.
Who is affected by CVE-2024-6229?
CVE-2024-6229 affects users of the Quivr application whose version is 0.0.281 or earlier.
What type of vulnerability is CVE-2024-6229?
CVE-2024-6229 is classified as a stored cross-site scripting (XSS) vulnerability.
How does CVE-2024-6229 work?
CVE-2024-6229 allows attackers to upload malicious JavaScript payloads via the 'Upload Knowledge' feature, which are then stored on the server and executed in user sessions.