← Back

CVE-2024-4023

nvd nist
Published: Mar 20, 2025Modified: Jun 17, 2026

JSON object

Loading...
8.1
Vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H
Exploitability: 2.8 / Impact: 5.2
Source: security@huntr.dev (Secondary)

Description

A stored cross-site scripting (XSS) vulnerability exists in flatpressblog/flatpress version 1.3. When a user uploads a file with a `.xsig` extension and directly accesses this file, the server responds with a Content-type of application/octet-stream, leading to the file being processed as an HTML file. This allows an attacker to execute arbitrary JavaScript code, which can be used to steal user cookies, perform HTTP requests, and access content of the same origin.

Affected (1)

Products: Flatpress: Flatpress
Flatpress
1 product
Flatpress
Configuration A
1 vulnerable
Vulnerable SoftwareAffected Versions
Flatpress
Version 1.3

Related CWEs

CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

References (2)

Source: security@huntr.dev
Patch
Source: security@huntr.dev
ExploitThird Party Advisory

Timeline

No history available yet.