Lucene search

MitreCVE-2024-44794

HistoryAug 26, 2024 - 8:15 p.m.

CVE-2024-44794

2024-08-2620:15:08

CWE-79

mitre

web.nvd.nist.gov

xss

picuploader

onedriveredirect

CVSS3

6.1

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

AI Score

5.6

Confidence

High

EPSS

0.001

Percentile

21.3%

JSON

A cross-site scripting (XSS) vulnerability in the component /master/auth/OnedriveRedirect.php of PicUploader commit fcf82ea allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the error_description parameter.

Affected configurations

Nvd

Node

xiebrucepicuploaderRange<2024-02-13

VendorProductVersionCPE
xiebrucepicuploader*cpe:2.3:a:xiebruce:picuploader:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
xiebruce	picuploader	*	cpe:2.3:a:xiebruce:picuploader::::::::

References

picuploader.com

github.com/xiebruce/PicUploader

github.com/xiebruce/PicUploader/issues/91

CVSS3

6.1

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

AI Score

5.6

Confidence

High

EPSS

0.001

Percentile

21.3%

JSON

Related for CVE-2024-44794