CVE-2024-55451

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2024-55451
A Stored Cross-Site Scripting (XSS) vulnerability exists in authenticated SVG file upload and viewing functionality in UJCMS 9.6.3. The vulnerability arises from insufficient sanitization of embedded attributes in uploaded SVG files. When a maliciously crafted SVG file is viewed by other backend users, it allows authenticated attackers to execute arbitrary JavaScript in the context of other backend users' browsers, potentially leading to the theft of sensitive tokens.

4.8 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 1.7 / Impact : 2.7

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required HIGH

User Interaction REQUIRED

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact NONE

Scope CHANGED

References
Link Resource
https://github.com/cydtseng/Vulnerability-Research/blob/main/ujcms/StoredXSS-SVGUpload.md Exploit Third Party Advisory
https://github.com/dromara/ujcms Product
https://github.com/cydtseng/Vulnerability-Research/blob/main/ujcms/StoredXSS-SVGUpload.md Exploit Third Party Advisory
Configurations

Configuration 1 (hide)

cpe:2.3:a:ujcms:ujcms:9.6.3:*:*:*:*:*:*:*
History

24 Apr 2025, 15:26

Type Values Removed Values Added
CPE cpe:2.3:a:ujcms:ujcms:9.6.3:*:*:*:*:*:*:*
First Time Ujcms
Ujcms ujcms
References () https://github.com/cydtseng/Vulnerability-Research/blob/main/ujcms/StoredXSS-SVGUpload.md - () https://github.com/cydtseng/Vulnerability-Research/blob/main/ujcms/StoredXSS-SVGUpload.md - Exploit, Third Party Advisory
References () https://github.com/dromara/ujcms - () https://github.com/dromara/ujcms - Product
Summary
  • (es) Existe una vulnerabilidad de Cross-Site Scripting (XSS) almacenado en la funcionalidad de carga y visualización de archivos SVG autenticados en UJCMS 9.6.3. La vulnerabilidad surge de una desinfección insuficiente de los atributos integrados en los archivos SVG cargados. Cuando otros usuarios del backend ven un archivo SVG manipulado con fines malintencionados, los atacantes autenticados pueden ejecutar código JavaScript arbitrario en el contexto de los navegadores de otros usuarios del backend, lo que puede llevar al robo de tokens confidenciales.

17 Dec 2024, 17:15

Type Values Removed Values Added
CWE CWE-79
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 4.8
References () https://github.com/cydtseng/Vulnerability-Research/blob/main/ujcms/StoredXSS-SVGUpload.md - () https://github.com/cydtseng/Vulnerability-Research/blob/main/ujcms/StoredXSS-SVGUpload.md -

16 Dec 2024, 23:15

Type Values Removed Values Added
New CVE
Information

Published : 2024-12-16 23:15

Updated : 2025-04-24 15:26

NVD link : CVE-2024-55451

Mitre link : CVE-2024-55451

CVE.ORG link : CVE-2024-55451

JSON object : View

Products Affected

ujcms

  • ujcms
CWE
CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')