VULNERABILITY INTELLIGENCE

CVE-2024-55451

CVSS score4.8 MEDIUM

EPSS probability0.32%

CISA KEVNot currently listed

Published2024-12-16

Last modified2026-06-17

CVSS vectorCVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

Description

A Stored Cross-Site Scripting (XSS) vulnerability exists in authenticated SVG file upload and viewing functionality in UJCMS 9.6.3. The vulnerability arises from insufficient sanitization of embedded attributes in uploaded SVG files. When a maliciously crafted SVG file is viewed by other backend users, it allows authenticated attackers to execute arbitrary JavaScript in the context of other backend users' browsers, potentially leading to the theft of sensitive tokens.

Weakness classification

134c704f-9b21-4f2e-91b3-4a467353bcc0: CWE-79

Primary references

cve@mitre.org — Exploit, Third Party Advisory
cve@mitre.org — Product
134c704f-9b21-4f2e-91b3-4a467353bcc0 — Exploit, Third Party Advisory