Description

Typebot is an open-source chatbot builder. A reflected cross-site scripting (XSS) in the sign-in page of typebot.io prior to version 2.24.0 may allow an attacker to hijack a user's account. The sign-in page takes the `redirectPath` parameter from the URL. If a user clicks on a link where the `redirectPath` parameter has a javascript scheme, the attacker that crafted the link may be able to execute arbitrary JavaScript with the privileges of the user. Version 2.24.0 contains a patch for this issue.

INFO

Published Date :

2024-04-04T20:18:08.993Z

Last Modified :

2024-08-02T01:32:06.369Z

Source :

GitHub_M
AFFECTED PRODUCTS

The following products are affected by CVE-2024-30264 vulnerability.

Vendors Products
Typebot
  • Typebot
REFERENCES

Here, you will find a curated list of external links that provide in-depth information to CVE-2024-30264.

URL Resource
https://github.com/baptisteArno/typebot.io/blob/v2.23.0/apps/builder/src/features/auth/components/SignInForm.tsx#L35 cve-icon cve-icon
https://github.com/baptisteArno/typebot.io/commit/d0be29e25732c410b561cbc3c5607c3c1d4b6c8e cve-icon cve-icon
https://github.com/baptisteArno/typebot.io/security/advisories/GHSA-mx2f-9mcr-8j73 cve-icon cve-icon
Login to claim this CVE

CVSS Vulnerability Scoring System

Detailed values of each vector for above chart.
Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality Impact
Integrity Impact
Availability Impact