CVE-2024-11623

Published: Feb 4, 2025Modified: Jun 17, 2026

4.8

Vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Show more

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:XShow less

Source: cvd@cert.pl (Secondary)

Description

Authentik project is vulnerable to Stored XSS attacks through uploading crafted SVG files that are used as application icons. This action could only be performed by an authenticated admin user. The issue was fixed in 2024.10.4 release.

Affected (1)

Products: Goauthentik: Authentik

1 product

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Goauthentik Authentik	Before 2024.10.4

Related CWEs

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

References (3)

https://cert.pl/en/posts/2025/02/CVE-2024-11623/

Source: cvd@cert.pl

Third Party Advisory

https://docs.goauthentik.io/docs/security/audits-and-certs/2024-11-cobalt#svg-images-for-icons-possible-xss-vulnerability

Source: cvd@cert.pl

Vendor Advisory

https://github.com/goauthentik/authentik/pull/12092

Source: cvd@cert.pl

Issue TrackingPatch

Timeline

No history available yet.