CVE-2024-55224
Published: 09 January 2025
Description
An HTML injection vulnerability in Vaultwarden prior to v1.32.5 allows attackers to execute arbitrary code via injecting a crafted payload into the username field of an e-mail message.
Security Summary
CVE-2024-55224 is an HTML injection vulnerability (CWE-79) in Vaultwarden versions prior to 1.32.5. The flaw enables attackers to execute arbitrary code by injecting a crafted payload into the username field of an email message.
Unauthenticated attackers can exploit this vulnerability remotely over the network with low attack complexity, though it requires user interaction. Successful exploitation achieves high-impact effects on confidentiality, integrity, and availability with a changed scope, earning a CVSS v3.1 base score of 9.6 (AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H).
Vaultwarden release notes for versions 1.32.4 and 1.32.5 address the issue, recommending an upgrade to v1.32.5 or later for mitigation. Further details appear in a vulnerability disclosure published on insinuator.net.
Details
- CWE(s)