CVE-2024-11623 MEDIUM

CVE-2024-11623: Stored XSS in authentik

Vendor Goauthentik
Product authentik
Weakness CWE-79 · XSS
Published February 4, 2025
Last update February 12, 2025
View on NVD All CVEs

CVSS base score

4.8/10
Attack vector Network
Attack complexity Low
Privileges required High
User interaction —
Confidentiality —
Integrity —

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N

What the vulnerability does

01Description

Authentik project is vulnerable to Stored XSS attacks through uploading crafted SVG files that are used as application icons.  This action could only be performed by an authenticated admin user. The issue was fixed in 2024.10.4 release.

Key dates

02Disclosure timeline

February 4, 2025 CVE published
February 12, 2025 Record updated