Vulnerability in Pwndoc
CVE-2024-55652
PenDoc is a penetration testing reporting application. Prior to commit 1d4219c596f4f518798492e48386a20c6e9a2fe6, an attacker can write a malicious docx template containing expressions that escape the JavaScript sandbox to execute arbitrary code on the system. An attacker who can control the contents of the template document is able to execute arbitrary code on the system. By default, only users with the `admin` role are able to create or update templates. Commit 1d4219c596f4f518798492e48386a20c6e9a2fe6 patches the issue.
EPSS: 0.007 (48.0th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 6.5 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N.
Affected products
- Pwndoc — versions < 1d4219c596f4f518798492e48386a20c6e9a2fe6
Weakness classification (CWE)
References
- security-advisories@github.com (x_refsource_CONFIRM)
- security-advisories@github.com (x_refsource_MISC)
- security-advisories@github.com (x_refsource_MISC)
Frequently asked questions
- What is CVE-2024-55652?
- CVE-2024-55652 is a medium-severity vulnerability in Pwndoc, classified under Improper Neutralization of Special Elements Used in a Template Engine. CVSS score: 6.5/10. Published 2024-12-12.
- How severe is CVE-2024-55652?
- Medium severity. CVSS v3 base score is 6.5 out of 10.