mirror of
https://github.com/fkie-cad/nvd-json-data-feeds.git
synced 2025-06-01 11:11:27 +00:00
28 lines
1.6 KiB
JSON
28 lines
1.6 KiB
JSON
{
|
|
"id": "CVE-2024-25712",
|
|
"sourceIdentifier": "cve@mitre.org",
|
|
"published": "2024-02-29T01:44:16.287",
|
|
"lastModified": "2024-02-29T13:49:29.390",
|
|
"vulnStatus": "Awaiting Analysis",
|
|
"descriptions": [
|
|
{
|
|
"lang": "en",
|
|
"value": "http-swagger before 1.2.6 allows XSS via PUT requests, because a file that has been uploaded (via httpSwagger.WrapHandler and *webdav.memFile) can subsequently be accessed via a GET request. NOTE: this is independently fixable with respect to CVE-2022-24863, because (if a solution continued to allow PUT requests) large files could have been blocked without blocking JavaScript, or JavaScript could have been blocked without blocking large files."
|
|
},
|
|
{
|
|
"lang": "es",
|
|
"value": "http-swagger anterior a 1.2.6 permite XSS a trav\u00e9s de solicitudes PUT, porque posteriormente se puede acceder a un archivo que se ha subido (a trav\u00e9s de httpSwagger.WrapHandler y *webdav.memFile) a trav\u00e9s de una solicitud GET. NOTA: esto se puede solucionar de forma independiente con respecto a CVE-2022-24863, porque (si una soluci\u00f3n continuara permitiendo solicitudes PUT) los archivos grandes podr\u00edan haberse bloqueado sin bloquear JavaScript, o JavaScript podr\u00eda haberse bloqueado sin bloquear archivos grandes."
|
|
}
|
|
],
|
|
"metrics": {},
|
|
"references": [
|
|
{
|
|
"url": "https://cosmosofcyberspace.github.io/improper_http_method_leads_to_xss/poc.html",
|
|
"source": "cve@mitre.org"
|
|
},
|
|
{
|
|
"url": "https://github.com/swaggo/http-swagger/releases/tag/v1.2.6",
|
|
"source": "cve@mitre.org"
|
|
}
|
|
]
|
|
} |