CVE-2024-45793

Advisory

Confidant affected versions contain a critical Cross-Site Scripting (XSS) vulnerability affecting multiple API endpoints for credential and service operations. This stored XSS flaw enables authenticated attackers with credential creation privileges to inject malicious scripts, potentially compromising other users' sessions, stealing sensitive information, or executing unauthorized actions. Inadequate input sanitization and improper content-type headers in API responses cause this vulnerability. Developers have patched the issue by implementing robust XSS protection measures, including security headers and proper content-type settings for API responses.

Affected package

Affected versions

Fixed versions

Vulnerability changelog

This vulnerability has no description

Resources

• https://github.com/lyft/confidant/commit/8876b07abde0c8d2a4974f79b60562b6d0193db9
• https://github.com/advisories/GHSA-rxq8-q85f-m866
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-45793