CVE-2024-39926— Vaultwarden 安全漏洞

N/A

An issue was discovered in Vaultwarden (formerly Bitwarden_RS) 1.30.3. A stored cross-site scripting (XSS) or, due to the default CSP, HTML injection vulnerability has been discovered in the admin dashboard. This potentially allows an authenticated attacker to inject malicious code into the dashboard, which is then executed or rendered in the context of an administrator's browser when viewing the injected content. However, it is important to note that the default Content Security Policy (CSP) of the application blocks most exploitation paths, significantly mitigating the potential impact.

N/A

N/A

Vaultwarden 安全漏洞

Vaultwarden是Daniel García个人开发者的一个用 Rust 编写的 Bitwarden 服务器 API 的替代实现。 Vaultwarden 1.30.3版本存在安全漏洞，该漏洞源于存在存储型跨站脚本(XSS)，允许经过身份验证的攻击者将恶意代码注入仪表板，然后在浏览器环境中执行或呈现该代码。

N/A

N/A