Cyber Resilience

CVE-2024-25292

CriticalPublic PoC

Published: 29 February 2024

Published
29 February 2024
Modified
27 March 2025
KEV Added
—
Patch
—
CVSS Score v3.1 9.6 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
EPSS Score 0.1196 93.9th percentile
Risk Priority 26 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2024-25292 is a critical-severity Cross-site Scripting (CWE-79) vulnerability in Martinbarker Rendertune. Its CVSS base score is 9.6 (Critical).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 6.1% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

Deeper analysis

RenderTune version 1.1.4 is affected by a cross-site scripting vulnerability that permits arbitrary web script or HTML execution when an attacker supplies a crafted payload in the Upload Title parameter. The flaw is tracked as CWE-79 and carries a CVSS 3.1 score of 9.6, reflecting network attack vector, low complexity, no required privileges, and changed scope with high impact on confidentiality, integrity, and availability.

An unauthenticated remote attacker can exploit the issue by delivering the malicious Upload Title value to a victim user, resulting in script execution within the victim's browser context and potential full compromise of the affected session or application data. Public proof-of-concept code demonstrating the injection has been published on GitHub.

The EPSS score remains flat at 0.1196 with no material rise after disclosure. No official advisories or vendor patches are referenced in the available sources.

EU & UK References

Vulnerability details

Cross-site scripting (XSS) vulnerability in RenderTune v1.1.4 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Upload Title parameter.

CWE(s)
CWE-79

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
attack.mitre.org →
T1203 Exploitation for Client Execution Execution
Adversaries may exploit software vulnerabilities in client applications to execute code.
attack.mitre.org →
T1059.007 JavaScript Execution
Adversaries may abuse various implementations of JavaScript for execution.
attack.mitre.org →
Why these techniques?

XSS via Upload Title enables exploitation of a potentially public-facing or client web interface (T1190/T1203) to execute arbitrary JavaScript (T1059.007). RCE PoC indicates facilitation of code execution.

Affected Assets

martinbarker
rendertune
1.1.4

Mitigating Controls

Likely Mitigating Controls AI

Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.

CA-8 Penetration Testing
addresses: CWE-79

Penetration testing submits XSS payloads to web applications, detecting cross-site scripting flaws for subsequent remediation.

SI-10 Information Input Validation
addresses: CWE-79

Validates web inputs to reject script-related content that could produce XSS.

SI-15 Information Output Filtering
addresses: CWE-79

Output validation against expected content can reject or sanitize script content in generated web pages, reducing XSS exploitability.

References