CVE-2024-50637: UnoPim Cross-site Scripting Vulnerability in User Creation
Summary
CVE-2024-50637: UnoPim Cross-site Scripting vulnerability. Affects unopim/unopim versions < 0.1.4. Fixed in 0.1.4. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
UnoPim is a package designed for user management within applications, allowing developers to create and manage user accounts efficiently. It is built on the Packagist ecosystem and is commonly used in PHP applications. However, versions 0.1.3 and below have been found to be vulnerable to a Cross-site Scripting (XSS) attack, particularly in the Create User function, which can compromise user data and application integrity.
Vulnerability Detail
The vulnerability arises from improper handling of SVG file extensions in the Create User function of UnoPim. Attackers can exploit this flaw to inject malicious scripts into the application, leading to potential cookie theft and unauthorized access to user sessions. This XSS vulnerability is classified under CWE-79, indicating a failure to sanitize user input properly, which can have severe implications for user privacy and security.
How To Fix
Minimum fixed version
0.1.4
This is the first release that contains the fix.
composer require unopim/unopim:0.1.4Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If immediate updating is not feasible, consider implementing input validation and sanitization for user inputs, especially for file uploads. This can help mitigate the risk of XSS attacks until the package is updated. Additionally, avoid allowing SVG file uploads until the vulnerability is resolved.
Conclusion
The UnoPim package has a critical vulnerability that allows for Cross-site Scripting attacks, particularly in its user creation functionality. It is essential to update to version 0.1.4 or later to mitigate this risk. Users should also consider implementing additional security measures and monitoring tools like Vulert to stay informed about potential vulnerabilities.
See every vulnerability recorded for unopim/unopim →
FAQ
XSS is a security vulnerability that allows attackers to inject malicious scripts into web pages viewed by other users, potentially leading to data theft and session hijacking.
You can check if your application is affected by using Vulert, which monitors open-source vulnerabilities in real-time. Visit Vulert Scanner to analyze your composer.lock file without any signup.
Exploitation of this vulnerability can lead to cookie theft, unauthorized access to user accounts, and potential data breaches, compromising user privacy and application security.
Yes, you can implement input validation and sanitization for user inputs and restrict SVG file uploads until the vulnerability is patched.
The CVSS score of this vulnerability is 6.1, indicating a moderate severity level that requires attention.
Related vulnerabilities
Recent vulnerabilities recorded for unopim/unopim.
