CVE - CVE-2024-51498

CVE-ID
CVE-2024-51498	Learn more at National Vulnerability Database (NVD) • CVSS Severity Rating • Fix Information • Vulnerable Software Versions • SCAP Mappings • CPE Information
Description
cobalt is a media downloader that doesn't piss you off. A malicious cobalt instance could serve links with the `javascript:` protocol, resulting in Cross-site Scripting (XSS) when the user tries to download an item from a picker. This issue has been present since commit `66bac03e`, was mitigated in commit `97977efa` (correctly configured web instances were no longer vulnerable) and fully fixed in commit `c4be1d3a` (included in release version 10.2.1). Users are advised to upgrade. Users unable to upgrade should enable a content-security-policy.
References
Note: References are provided for the convenience of the reader to help distinguish between vulnerabilities. The list is not intended to be complete.
MISC:https://github.com/imputnet/cobalt/commit/66bac03e3078e4e781d2d3903c05ad66a883a354 URL:https://github.com/imputnet/cobalt/commit/66bac03e3078e4e781d2d3903c05ad66a883a354 MISC:https://github.com/imputnet/cobalt/commit/97977efabd92375f270d1818f38de3b0682c2f19 URL:https://github.com/imputnet/cobalt/commit/97977efabd92375f270d1818f38de3b0682c2f19 MISC:https://github.com/imputnet/cobalt/commit/c4be1d3a37b0deb6b6087ec7a815262ac942daf1 URL:https://github.com/imputnet/cobalt/commit/c4be1d3a37b0deb6b6087ec7a815262ac942daf1 MISC:https://github.com/imputnet/cobalt/security/advisories/GHSA-cm4c-v4cm-3735 URL:https://github.com/imputnet/cobalt/security/advisories/GHSA-cm4c-v4cm-3735
Assigning CNA
GitHub (maintainer security advisories)
Date Record Created
20241028	Disclaimer: The record creation date may reflect when the CVE ID was allocated or reserved, and does not necessarily indicate when this vulnerability was discovered, shared with the affected vendor, publicly disclosed, or updated in CVE.
Phase (Legacy)
Assigned (20241028)
Votes (Legacy)

Comments (Legacy)

Proposed (Legacy)
N/A
This is an record on the CVE List, which provides common identifiers for publicly known cybersecurity vulnerabilities.
Search CVE Using Keywords: You can also search by reference using the CVE Reference Maps.
For More Information: CVE Request Web Form (select "Other" from dropdown)