CVE-2024-47885

Summary

CVE-2024-47885 is a DOM Clobbering vulnerability affecting the Astro web framework. In versions 3.0.0 and earlier than 4.16.1, Astro's client-side router contains this issue. Attackers can leverage this vulnerability to inject cross-site scripting (XSS) code in websites utilizing Astro's client-side routing and storing user-inserted scriptless HTML elements, particularly `iframe` tags with unsanitized `name` attributes, on their pages. This can result in XSS attacks that can manipulate user interactions and steal sensitive information. Version 4.16.1 includes a patch to resolve this issue.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.