CVE-2024-52597

Summary

CVE-2024-52597 is a stored cross-site scripting vulnerability affecting versions prior to 5.4.1 of the 2FAuth web application. Malicious SVG images, which are accepted by the application, can contain JavaScript code that is executed when accessed. An attacker can upload such an image and lure a victim to it, leading to session compromise and unauthorized access to tokens. The vulnerability is due to improper headers in the direct access to uploaded SVGs. Version 5.4.1 includes a patch to address this issue.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.