CVE-2024-47075

Summary

CVE-2024-47075 is a DOM Clobbering vulnerability affecting LayUI, a popular minimalist modular Web UI component library. This issue, present in versions prior to 2.9.17, can lead to Cross-site Scripting (XSS) attacks on web pages. The vulnerability arises when LayUI fails to adequately sanitize `name` attributes in `img` tags, allowing attackers to inject malicious scripts. Version 2.9.17 addresses this issue by implementing proper input validation to prevent such attacks. Web developers using LayUI are urged to update to the latest version to mitigate this risk.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.