What is CVE-2024-49379?

CVE-2024-49379 is a vulnerability in Getumbrel Umbrel, classified under Cross-site Scripting. Published 2024-11-13.

Is CVE-2024-49379 known to be exploited?

2 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.

XSS in Getumbrel Umbrel

CVE-2024-49379

Umbrel is a home server OS for self-hosting. The login functionality of Umbrel before version 1.2.2 contains a reflected cross-site scripting (XSS) vulnerability in use-auth.tsx. An attacker can specify a malicious redirect query parameter…

Vulnerability class: XSS (Cross-Site Scripting)

EPSS: 0.012 (65.3th percentile) — read the EPSS interpretation.

Affected products

Getumbrel Umbrel — versions < 1.2.2

Weakness classification (CWE)

CWE-79 — Cross-site Scripting

Public proof-of-concept exploits

References

security-advisories@github.com (x_refsource_CONFIRM)
security-advisories@github.com (x_refsource_MISC)
security-advisories@github.com (x_refsource_MISC)

Frequently asked questions

What is CVE-2024-49379?: CVE-2024-49379 is a vulnerability in Getumbrel Umbrel, classified under Cross-site Scripting. Published 2024-11-13.
Is CVE-2024-49379 known to be exploited?: 2 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.