CVE-2024-22414 User profile page vulnerable to Cross Site Scripting (XSS) in flaskBlog
Attackers can execute arbitrary JavaScript via stored comments in flaskBlog due to unsafe template rendering, requiring manual code modification to fix.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2024-22414?
CVE-2024-22414 is a medium-severity cross-site scripting vulnerability in DogukanUrker flaskBlog, published on 17 Jan 2024. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.
Official description
flaskBlog is a simple blog app built with Flask. Improper storage and rendering of the `/user/<user>` page allows a user's comments to execute arbitrary javascript code. The html template `user.html` contains the following code snippet to render comments made by a user: `<div class="content" tag="content">{{comment[2]|safe}}</div>`. Use of the "safe" tag causes flask to _not_ escape the rendered content. To remediate this, simply remove the `|safe` tag from the HTML above. No fix is is available and users are advised to manually edit their installation.
Weakness: CWE-79
Which versions are affected by CVE-2024-22414?
It affects 1 product.
Products include Dogukanurker Flaskblog.
How do I fix CVE-2024-22414?
No fix has been published for CVE-2024-22414 yet. Limit exposure of the affected software until one is available.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2024-22414 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2024-22414 exists.
Other vulnerabilities in DogukanUrker flaskBlog
Sources
Also known as GHSA-mrcw-j96f-p6v6.