CVE-2024-50344
MEDIUM EPSS 19.4%
Published Oct 30, 20241y ago · Modified Jun 17, 20262w ago
4.6 CVSS 3.1
Published Oct 30, 2024 1y ago
Last Modified Jun 17, 2026 2w ago
Description
I, Librarian is an open-source version of a PDF managing SaaS. Supplemental Files are allowed to be viewed in the browser, only if they have a white-listed MIME type. Unfortunately, this logic is broken, thus allowing unsafe files containing Javascript to be executed with the application context. An attacker can exploit this vulnerability by uploading a supplementary file that contains a malicious code or script. This code will then be executed when the file is loaded in the browser. The vulnerability was fixed in version 5.11.2.
CVSS Details
Base Score
Exploitability
Impact
Vector string
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N Attack Vector Network
Attack Complexity Low
Privileges Required Low
User Interaction Required
Scope Unchanged
Confidentiality Low
Integrity Low
Availability None
Threat Intelligence
EPSS Exploit Probability
19.4% percentile
Exploit & Patch Status
No Known Exploit
No Patch Available
Weaknesses 1
CWE-80
References 2
- github.com https://github.com/mkucej/i-librarian-free/commit/a67d7949ffb02fd912ebdcf552df006b44066d78
- github.com https://github.com/mkucej/i-librarian-free/security/advisories/GHSA-c2rm-w62w-5xmj
Remediation
No remediation data recorded yet
Check vendor advisories and the NVD entry for patch availability.