CVE-2024-51492

See a problem?
Please try reporting it to the source first.
Source
https://nvd.nist.gov/vuln/detail/CVE-2024-51492
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-51492.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2024-51492
Aliases
  • GHSA-96fx-5rqv-jfxh
Published
2024-11-01T16:22:46.645Z
Modified
2025-12-05T07:18:37.614668Z
Severity
  • 8.8 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:L CVSS Calculator
Summary
Zusam vulnerable to stored XSS, allowing token theft via crafted SVG
Details

Zusam is a free and open-source way to self-host private forums. Prior to version 0.5.6, specially crafted SVG files uploaded to the service as images allow for unrestricted script execution on (raw) image load. With certain payloads, theft of the target user’s long-lived session token is possible. Note that Zusam, at the time of writing, uses a user’s static API key as a long-lived session token, and these terms can be used interchangeably on the platform. This session token/API key remains valid indefinitely, so long as the user doesn’t expressly request a new one via their Settings page. Version 0.5.6 fixes the cross-site scripting vulnerability.

Database specific 
{
    "cna_assigner": "GitHub_M",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/51xxx/CVE-2024-51492.json",
    "cwe_ids": [
        "CWE-79"
    ]
}
References

Affected packages

Git / github.com/zusam/zusam

Affected ranges

Type
GIT
Repo
https://github.com/zusam/zusam
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
5930fdf86fa4abed01f0b345c8ec3c443656db9a

Affected versions

0.*

0.1
0.1-alpha.1
0.1-alpha.2
0.1-alpha.3
0.1-alpha.4
0.1-alpha.5
0.1-alpha.6
0.1-alpha.7
0.1-beta.1
0.1-beta.2
0.1-beta.3
0.1-beta.4
0.1-beta.5
0.1-beta.6
0.1-beta.7
0.1.1
0.2
0.3
0.3.1
0.3.2
0.4
0.4.1
0.4.2
0.4.3
0.4.4
0.4.5
0.5
0.5.1
0.5.2
0.5.3
0.5.4
0.5.5

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-51492.json"