XSS in Quivr
CVE-2024-6229
A stored cross-site scripting (XSS) vulnerability exists in the 'Upload Knowledge' feature of stangirard/quivr, affecting the latest version. Users can upload files via URL, which allows the insertion of malicious JavaScript payloads. These payloads are stored on the server and executed whenever any user clicks on a link containing the payload, leading to potential data theft, session hijacking, and reputation damage.
Vulnerability class: XSS (Cross-Site Scripting)
EPSS: 0.003 (27.3th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 5.4 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N.
Affected products
- Quivr
- Stangirard Stangirard/quivr — versions unspecified
Weakness classification (CWE)
Public proof-of-concept exploits
References
- security@huntr.dev (Exploit)
Frequently asked questions
- What is CVE-2024-6229?
- CVE-2024-6229 is a medium-severity vulnerability in Quivr, classified under Cross-site Scripting. CVSS score: 5.4/10. Published 2024-07-07.
- How severe is CVE-2024-6229?
- Medium severity. CVSS v3 base score is 5.4 out of 10.
- Is CVE-2024-6229 known to be exploited?
- 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.