CVE-2024-21501
Published: 24 February 2024
Summary
CVE-2024-21501 is a medium-severity Exposure of Sensitive Information to an Unauthorized Actor (CWE-200) vulnerability in Fedoraproject Fedora. Its CVSS base score is 5.3 (Medium).
Operationally, ranked in the top 16.8% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2024-0719
Vulnerability details
Versions of the package sanitize-html before 2.12.1 are vulnerable to Information Exposure when used on the backend and with the style attribute allowed, allowing enumeration of files in the system (including project dependencies). An attacker could exploit this vulnerability to…
more
gather details about the file system structure and dependencies of the targeted server.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Review and removal of nonpublic information from publicly accessible systems directly prevents exposure of sensitive data to unauthorized actors.
Monitoring directly detects unauthorized disclosure of sensitive information, enabling response to exposures.
A data action map identifies locations where sensitive information may be exposed to unauthorized actors during processing or transfer.
The control's identification, isolation, alerting, and eradication steps directly limit the impact and exploitation window of unauthorized sensitive information exposure.
Categorization identifies sensitive data so that confidentiality protections commensurate with impact level are selected and documented.
The assessment process surfaces design decisions that could expose sensitive (including PII) data to unauthorized actors, prompting controls that reduce such exposure.
Tainting directly detects exfiltration resulting from exposure of sensitive information to unauthorized actors.
OPSEC controls directly protect supply chain information from unauthorized observation or disclosure.