CVE-2024-25712
See a problem?- Source
- https://nvd.nist.gov/vuln/detail/CVE-2024-25712
- Import Source
- https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-25712.json
- JSON Data
- https://api.osv.dev/v1/vulns/CVE-2024-25712
- Aliases
- Published
- 2024-02-29T01:44:16Z
- Modified
- 2024-05-14T13:10:02.084072Z
- Summary
- [none]
- Details
-
http-swagger before 1.2.6 allows XSS via PUT requests, because a file that has been uploaded (via httpSwagger.WrapHandler and *webdav.memFile) can subsequently be accessed via a GET request. NOTE: this is independently fixable with respect to CVE-2022-24863, because (if a solution continued to allow PUT requests) large files could have been blocked without blocking JavaScript, or JavaScript could have been blocked without blocking large files.
- References