CVE-2024-47531

CVSS V2 None CVSS V3 None

Description

Scout is a web-based visualizer for VCF-files. Due to the lack of sanitization in the filename, it is possible bypass intended file extension and make users download malicious files with any extension. With malicious content injected inside the file data and users unknowingly downloading it and opening may lead to the compromise of users' devices or data. This vulnerability is fixed in 4.89.

Overview

CVE ID
CVE-2024-47531

Assigner
GitHub_M

Vulnerability Status
PUBLISHED

Published Version
2024-09-30T15:26:49.421Z

Last Modified Date
2024-09-30T16:31:07.889Z

Weakness Enumerations

CWE	URL
CWE-116	http://cwe.mitre.org/data/definitions/116.html

References

Reference URL	Reference Tags
https://github.com/Clinical-Genomics/scout/security/advisories/GHSA-24xv-q29v-3h6r	x_refsource_CONFIRM
https://github.com/Clinical-Genomics/scout/commit/f59e50f8ea596e641da8a0e9c7a33c0696bcbea5	x_refsource_MISC

Sources

Source Name	Source URL
NIST	https://nvd.nist.gov/vuln/detail/CVE-2024-47531
MITRE	https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-47531

History

Created	Old Value	New Value	Data Type	Notes
2024-10-06 19:58:38				Added to TrackCVE