CVE-2024-32484
Published: 22 July 2024
Summary
CVE-2024-32484 is a high-severity Basic XSS (CWE-80) vulnerability in Ankitects Anki. Its CVSS base score is 7.4 (High).
Operationally, ranked in the top 8.2% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
Deeper analysis
CVE-2024-32484 is a reflected cross-site scripting vulnerability in the Flask server component of Ankitects Anki version 24.04. The flaw arises during handling of invalid paths and is assigned CWE-79 and CWE-80. A specially crafted flashcard can cause JavaScript execution that results in arbitrary file read, with a CVSS 3.1 score of 7.4 reflecting network attack vector, low complexity, no required privileges, required user interaction, changed scope, and high confidentiality impact.
An attacker can exploit the issue by sharing a malicious flashcard with a victim. When the victim interacts with the card, the reflected XSS payload executes in the browser, enabling the attacker to read arbitrary files from the victim's system.
The EPSS score remains flat at 0.0718 with no material increase after disclosure. The primary reference is the Talos Intelligence advisory TALOS-2024-1995.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2024-34463
Vulnerability details
An reflected XSS vulnerability exists in the handling of invalid paths in the Flask server in Ankitects Anki 24.04. A specially crafted flashcard can lead to JavaScript code execution and result in an arbitrary file read. An attacker can share…
more
a malicious flashcard to trigger this vulnerability.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Penetration testing submits XSS payloads to web applications, detecting cross-site scripting flaws for subsequent remediation.
Validates web inputs to reject script-related content that could produce XSS.
Output validation against expected content can reject or sanitize script content in generated web pages, reducing XSS exploitability.