CVE-2024-47531

Scout is a web-based visualizer for VCF-files. Due to the lack of sanitization in the filename, it is possible bypass intended file extension and make users download malicious files with any extension. With malicious content injected inside the file data and users unknowingly downloading it and opening may lead to the compromise of users' devices or data. This vulnerability is fixed in 4.89.

CVSS v3 4.6 MEDIUM

4.6^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.1 / Impact : 2.5

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction REQUIRED

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://github.com/Clinical-Genomics/scout/commit/f59e50f8ea596e641da8a0e9c7a33c0696bcbea5	Patch
https://github.com/Clinical-Genomics/scout/security/advisories/GHSA-24xv-q29v-3h6r	Exploit Third Party Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:clinical-genomics:scout:*:*:*:*:*:*:*:*

History

No history.

Information

Published : 2024-09-30 16:15

Updated : 2024-11-15 18:02

NVD link : CVE-2024-47531

Mitre link : CVE-2024-47531

CVE.ORG link : CVE-2024-47531

JSON object : View

Products Affected

clinical-genomics

scout

CWE

CWE-116

Improper Encoding or Escaping of Output

{"id": "CVE-2024-47531", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.6, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}, "impactScore": 2.5, "exploitabilityScore": 2.1}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 3.5, "attackVector": "NETWORK", "baseSeverity": "LOW", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}, "impactScore": 1.4, "exploitabilityScore": 2.1}]}, "published": "2024-09-30T16:15:09.750", "references": [{"url": "https://github.com/Clinical-Genomics/scout/commit/f59e50f8ea596e641da8a0e9c7a33c0696bcbea5", "tags": ["Patch"], "source": "security-advisories@github.com"}, {"url": "https://github.com/Clinical-Genomics/scout/security/advisories/GHSA-24xv-q29v-3h6r", "tags": ["Exploit", "Third Party Advisory"], "source": "security-advisories@github.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-116"}]}], "descriptions": [{"lang": "en", "value": "Scout is a web-based visualizer for VCF-files. Due to the lack of sanitization in the filename, it is possible bypass intended file extension and make users download malicious files with any extension. With malicious content injected inside the file data and users unknowingly downloading it and opening may lead to the compromise of users' devices or data. This vulnerability is fixed in 4.89."}, {"lang": "es", "value": "Scout es un visualizador web para archivos VCF. Debido a la falta de desinfecci\u00f3n en el nombre de archivo, es posible eludir la extensi\u00f3n de archivo deseada y hacer que los usuarios descarguen archivos maliciosos con cualquier extensi\u00f3n. Si se inyecta contenido malicioso dentro de los datos del archivo y los usuarios lo descargan y abren sin saberlo, es posible que se vean comprometidos los dispositivos o los datos de los usuarios. Esta vulnerabilidad se solucion\u00f3 en la versi\u00f3n 4.89."}], "lastModified": "2024-11-15T18:02:14.250", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:clinical-genomics:scout:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "44ADA126-F97E-4ADC-AE4C-7C54D3375D19", "versionEndExcluding": "4.89"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}