CVE-2024-11623

Feb. 4, 2025, 2:15 p.m.

None
No Score

Description

Authentik project is vulnerable to Stored XSS attacks through uploading crafted SVG files that are used as application icons.  This action could only be performed by an authenticated admin user. The issue was fixed in 2024.10.4 release.

Product(s) Impacted

Product Versions
Authentik
  • 2024.10.4

Weaknesses

CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

References

https://cert.pl/en/posts/2025/02/CVE-2024-11623/
https://docs.goauthentik.io/docs/security/audits-and-certs/2024-11-cobalt#svg-images-for-icons-possible-xss-vulnerability
https://github.com/goauthentik/authentik/pull/12092

Tags

CWE-79
cvd@cert.pl
2025-02-04
CVE-2024-11623

Date

  • Published: Feb. 4, 2025, 2:15 p.m.
  • Last Modified: Feb. 4, 2025, 2:15 p.m.

Status : Awaiting Analysis

CVE has been recently published to the CVE List and has been received by the NVD.

More info

Source

cvd@cert.pl

*Disclaimer: Some vulnerabilities do not have an associated CPE. To enhance the data, we use AI to infer CPEs based on CVE details. This is an automated process and might not always be accurate.