VulnerabilityAnalyzed

CVE-2024-53999

The application allows users to upload files with scripts in the filename parameter.

MEDIUM 5.4EPSS 0.52%

Does this matter?

Lower severity and a low EPSS score (0.52%). Track it; it rarely justifies an emergency change on its own.

Description

Mobile Security Framework (MobSF) is a pen-testing, malware analysis and security assessment framework capable of performing static and dynamic analysis. The application allows users to upload files with scripts in the filename parameter. As a result, a malicious user can upload a script file to the system. When users in the application use the "Diff or Compare" functionality, they are affected by a Stored Cross-Site Scripting vulnerability. This vulnerability is fixed in 4.2.9.

CVSS 3.1: 5.4 MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
EPSS: 0.52% probability · 42th percentile
CISA KEV: Not listed
Weakness: CWE-79
Affected: opensecurity/mobile security framework
Source: security-advisories@github.com

References

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.