CVE-2024-32484
CVE-2024-32484
This page contains facts from public vulnerability sources. Check the original advisory before updating.
An reflected XSS vulnerability exists in the handling of invalid paths in the Flask server in Ankitects Anki 24.04. A specially crafted flashcard can lead to JavaScript code execution and result in an arbitrary file read. An attacker can share a malicious flashcard to trigger this vulnerability.
CVSS 7.4 · High · EPSS 21.5%
- Published
- Updated
Stack: system
Affected products and versions
anki
- Versions
- 24.04: Affected
No fix published
anki Debian:11
- Versions
- 2.1.15+dfsg-3
- 2.1.15+dfsg-4
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
anki Ubuntu:16.04:LTS
- Versions
- 2.0.32+dfsg-1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
anki Ubuntu:18.04:LTS
- Versions
- 2.1.0+dfsg~a12-0.1
- 2.1.0+dfsg~b24-1
- 2.1.0+dfsg~b25-1
- 2.1.0+dfsg~b26-1
- 2.1.0+dfsg~b27-1
- 2.1.0+dfsg~b29-1
- 2.1.0+dfsg~b31-1
- 2.1.0+dfsg~b33-1
- 2.1.0+dfsg~b34-1
- 2.1.0+dfsg~b35-1
- 2.1.0+dfsg~b36-1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
anki Ubuntu:20.04:LTS
- Versions
- 2.1.8+dfsg-1ubuntu1
- 2.1.15+dfsg-1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
anki Ubuntu:22.04:LTS
- Versions
- 2.1.15+dfsg-3
- 2.1.15+dfsg-3ubuntu0.1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
anki Ubuntu:24.04:LTS
- Versions
- 2.1.15+dfsg-3ubuntu1
- 2.1.15+dfsg-3ubuntu2
- 2.1.15+dfsg-3ubuntu3
- 2.1.15+dfsg-3ubuntu4
- 2.1.15+dfsg-3ubuntu4.1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published