Vulnerability Description
Multiple stored cross-site scripting (“XSS”) vulnerabilities in the markdown dashboard and dashboard comment functionality of Lightdash version 0.1024.6 allows remote authenticated threat actors to inject malicious scripts into vulnerable web pages. A threat actor could potentially exploit this vulnerability to store malicious JavaScript which executes in the context of a user’s session with the application.
CVSS Score
MEDIUM
Related Weaknesses (CWE)
References
- https://github.com/google/security-research/security/advisories/GHSA-6529-6jv3-6
- https://github.com/lightdash/lightdash
- https://github.com/lightdash/lightdash/pull/9359
- https://github.com/lightdash/lightdash/pull/9510
- https://github.com/lightdash/lightdash/releases/tag/0.1042.2
- https://patch-diff.githubusercontent.com/raw/lightdash/lightdash/pull/9359.patch
- https://patch-diff.githubusercontent.com/raw/lightdash/lightdash/pull/9510.patch
- https://www.cve.org/CVERecord?id=CVE-2024-6585
FAQ
What is CVE-2024-6585?
CVE-2024-6585 is a vulnerability with a CVSS score of 5.4 (MEDIUM). Multiple stored cross-site scripting (“XSS”) vulnerabilities in the markdown dashboard and dashboard comment functionality of Lightdash version 0.1024.6 allows remote authenticated threat actors to in...
How severe is CVE-2024-6585?
CVE-2024-6585 has been rated MEDIUM with a CVSS base score of 5.4/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2024-6585?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.