CVE-2024-12326

MEDIUM EPSS 13.8%
Published Dec 6, 20241y ago · Modified Jun 17, 20262w ago
6.1 CVSS 3.1
Medium
Find Similar
Published Dec 6, 2024 1y ago
Last Modified Jun 17, 2026 2w ago

Description

Jirafeau normally prevents browser preview for SVG files due to the possibility that manipulated SVG files could be exploited for cross site scripting. This was done by storing the MIME type of a file and preventing the browser preview for MIME type image/svg+xml. This issue was first reported in CVE-2022-30110. However, it was still possible to do a browser preview of a SVG file by sending a manipulated MIME type during the upload, where the case of any letter in image/svg+xml had been changed (like image/svg+XML). The check for image/svg+xml has been changed to be case insensitive.

CVSS Details

Base Score
6.1
Exploitability
2.8
Impact
2.7
Vector string
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Attack Vector Network
Attack Complexity Low
Privileges Required None
User Interaction Required
Scope Changed
Confidentiality Low
Integrity Low
Availability None

Threat Intelligence

EPSS Exploit Probability
13.8% percentile
Exploit & Patch Status
No Known Exploit
Patch Available

Weaknesses 1

CWE-79 Cross-site Scripting Injection

Affected Products 1

VendorProductVersionRange
jirafeaujirafeau* <4.6.1

References 2

  • gitlab.com https://gitlab.com/jirafeau/Jirafeau/-/commit/6cfca8753d54e2025c6020b2af32529e25f58c66
    Patch
  • cve.org https://www.cve.org/CVERecord?id=CVE-2022-30110
    Not Applicable

Remediation

  • gitlab.com https://gitlab.com/jirafeau/Jirafeau/-/commit/6cfca8753d54e2025c6020b2af32529e25f58c66
    Patch