CVE-2024-12374 — Stored XSS in automatic1111/stable-diffusion-webui

CVE-2024-12374

Stored XSS in automatic1111/stable-diffusion-webui PUBLISHED

Description (CNA)

A stored cross-site scripting (XSS) vulnerability exists in automatic1111/stable-diffusion-webui version git 82a973c. An attacker can upload an HTML file, which the application interprets as content-type application/html. If a victim accesses the malicious link, it will execute arbitrary JavaScript in the victim's browser.

Affected (CNA)

Vendor / product	Versions
automatic1111 / automatic1111/stable-diffusion-webui	affected unspecified through latest

CWE

CWE-79

References

https://huntr.com/bounties/3dae386a-f442-4be6-87ef-956606c8a6ac

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.