CVE-2024-9427: Koji Cross-site Scripting

December 24, 2024 (updated February 7, 2025)

A vulnerability in Koji was found. An unsanitized input allows for an XSS attack. Javascript code from a malicious link could be reflected in the resulting web page. It is not expected to be able to submit an action or make a change in Koji due to existing XSS protections in the code.

References

access.redhat.com/security/cve/CVE-2024-9427
bugzilla.redhat.com/show_bug.cgi?id=2316047
docs.pagure.org/koji/CVEs/CVE-2024-9427
github.com/advisories/GHSA-g2vg-8hfg-79vj
nvd.nist.gov/vuln/detail/CVE-2024-9427
pagure.io/koji
pagure.io/koji/c/8c72d90d7bb991f8fb193851b80847ac9e9474a4?branch=master

Code Behaviors & Features

Detect and mitigate CVE-2024-9427 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →