CVE-2024-25712

Source
https://nvd.nist.gov/vuln/detail/CVE-2024-25712
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-25712.json
Aliases
Published
2024-02-29T01:44:16Z
Modified
2024-03-02T20:20:46.460956Z
Details

http-swagger before 1.2.6 allows XSS via PUT requests, because a file that has been uploaded (via httpSwagger.WrapHandler and *webdav.memFile) can subsequently be accessed via a GET request. NOTE: this is independently fixable with respect to CVE-2022-24863, because (if a solution continued to allow PUT requests) large files could have been blocked without blocking JavaScript, or JavaScript could have been blocked without blocking large files.

References

Affected packages

Git / github.com/swaggo/http-swagger

Affected ranges

Type
GIT
Repo
https://github.com/swaggo/http-swagger
Events
Introduced
0The exact introduced commit is unknown
Fixed

Affected versions

v1.*

v1.0.0
v1.1.1
v1.1.2
v1.2.0
v1.2.1
v1.2.5