> CVE-2024-49379

« BACK_TO_HOME
PUBLISHED
2024-11-13 18:15
MODIFIED
2024-11-21 17:15
EPSS (Prob. Exploit)
1.29%
Top 29.7%
DATA SOURCES:
NVD 🔗 2025-10-18 CVE PROJECT 🔗 2026-01-19 FIRST EPSS 🔗 2026-11-08 OSV 🔗 2026-11-08

> DESCRIPTION

Umbrel is a home server OS for self-hosting. The login functionality of Umbrel before version 1.2.2 contains a reflected cross-site scripting (XSS) vulnerability in use-auth.tsx. An attacker can specify a malicious redirect query parameter to trigger the vulnerability. If a JavaScript URL is passed to the redirect parameter the attacker provided JavaScript will be executed after the user entered their password and clicked on login. This vulnerability is fixed in 1.2.2.

> AFFECTED_PRODUCTS

ℹ️ Aucun produit affecté n'a encore été publié par NVD pour cette CVE.

> OSV (GOOGLE OPEN SOURCE VULNERABILITIES)

Remote Code Execution (RCE) via Cross-Site Scripting (XSS) in Umbrel

AFFECTED PACKAGES:
Unknown / Unknown
74 versions affected

> HISTORIQUE DES MODIFICATIONS

Première apparition
13/11/2024 18:15
Source: NVD
📊 ENRICHISSEMENT 18/10/2025 14:56
CVEPROJECT
Champ modifié: CVE Project
Ancienne valeur:
Non
Nouvelle valeur:
Oui
Total des modifications: 1 Dernière mise à jour: 1 year ago
« BACK_TO_HOME