nvd-json-data-feeds/CVE-2024/CVE-2024-257xx/CVE-2024-25712.json

{
  "id": "CVE-2024-25712",
  "sourceIdentifier": "cve@mitre.org",
  "published": "2024-02-29T01:44:16.287",
  "lastModified": "2024-02-29T13:49:29.390",
  "vulnStatus": "Awaiting Analysis",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "http-swagger before 1.2.6 allows XSS via PUT requests, because a file that has been uploaded (via httpSwagger.WrapHandler and *webdav.memFile) can subsequently be accessed via a GET request. NOTE: this is independently fixable with respect to CVE-2022-24863, because (if a solution continued to allow PUT requests) large files could have been blocked without blocking JavaScript, or JavaScript could have been blocked without blocking large files."
    },
    {
      "lang": "es",
      "value": "http-swagger anterior a 1.2.6 permite XSS a trav\u00e9s de solicitudes PUT, porque posteriormente se puede acceder a un archivo que se ha subido (a trav\u00e9s de httpSwagger.WrapHandler y *webdav.memFile) a trav\u00e9s de una solicitud GET. NOTA: esto se puede solucionar de forma independiente con respecto a CVE-2022-24863, porque (si una soluci\u00f3n continuara permitiendo solicitudes PUT) los archivos grandes podr\u00edan haberse bloqueado sin bloquear JavaScript, o JavaScript podr\u00eda haberse bloqueado sin bloquear archivos grandes."
    }
  ],
  "metrics": {},
  "references": [
    {
      "url": "https://cosmosofcyberspace.github.io/improper_http_method_leads_to_xss/poc.html",
      "source": "cve@mitre.org"
    },
    {
      "url": "https://github.com/swaggo/http-swagger/releases/tag/v1.2.6",
      "source": "cve@mitre.org"
    }
  ]
}