{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2024-9427", "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "state": "PUBLISHED", "assignerShortName": "redhat", "dateReserved": "2024-10-02T02:30:27.642Z", "datePublished": "2024-12-24T03:25:27.815Z", "dateUpdated": "2025-08-30T21:00:59.012Z"}, "containers": {"cna": {"title": "Koji: escape html tag characters in the query string", "metrics": [{"other": {"content": {"value": "Moderate", "namespace": "https://access.redhat.com/security/updates/classification/"}, "type": "Red Hat severity rating"}}, {"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N", "version": "3.1"}, "format": "CVSS"}], "descriptions": [{"lang": "en", "value": "A vulnerability in Koji was found. An unsanitized input allows for an XSS attack. Javascript code from a malicious link could be reflected in the resulting web page. It is not expected to be able to submit an action or make a change in Koji due to existing XSS protections in the code"}], "affected": [{"versions": [{"status": "affected", "version": "0", "lessThan": "1.35.1", "versionType": "semver"}], "packageName": "koji", "collectionURL": "https://github.com/koji-project/koji", "defaultStatus": "unaffected"}], "references": [{"url": "https://access.redhat.com/security/cve/CVE-2024-9427", "tags": ["vdb-entry", "x_refsource_REDHAT"]}, {"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2316047", "name": "RHBZ#2316047", "tags": ["issue-tracking", "x_refsource_REDHAT"]}], "datePublic": "2024-10-02T00:00:00.000Z", "problemTypes": [{"descriptions": [{"cweId": "CWE-116", "description": "Improper Encoding or Escaping of Output", "lang": "en", "type": "CWE"}]}], "x_redhatCweChain": "CWE-116: Improper Encoding or Escaping of Output", "timeline": [{"lang": "en", "time": "2024-10-02T02:29:49.603000+00:00", "value": "Reported to Red Hat."}, {"lang": "en", "time": "2024-10-02T00:00:00+00:00", "value": "Made public."}], "credits": [{"lang": "en", "value": "Red Hat would like to thank James Taliaferro (Lawrence Livermore National Laboratory) for reporting this issue."}], "providerMetadata": {"orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "shortName": "redhat", "dateUpdated": "2025-08-30T21:00:59.012Z"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2024-12-24T15:43:07.454511Z", "id": "CVE-2024-9427", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-12-24T15:43:15.164Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-9427", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-12-24T15:43:07.454511Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-12-24T15:43:11.707Z"}}], "cna": {"title": "Koji: escape html tag characters in the query string", "credits": [{"lang": "en", "value": "Red Hat would like to thank James Taliaferro (Lawrence Livermore National Laboratory) for reporting this issue."}], "metrics": [{"other": {"type": "Red Hat severity rating", "content": {"value": "Moderate", "namespace": "https://access.redhat.com/security/updates/classification/"}}}, {"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.4, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}}], "affected": [{"versions": [{"status": "affected", "version": "0", "lessThan": "1.35.1", "versionType": "semver"}], "packageName": "koji", "collectionURL": "https://github.com/koji-project/koji", "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2024-10-02T02:29:49.603000+00:00", "value": "Reported to Red Hat."}, {"lang": "en", "time": "2024-10-02T00:00:00+00:00", "value": "Made public."}], "datePublic": "2024-10-02T00:00:00.000Z", "references": [{"url": "https://access.redhat.com/security/cve/CVE-2024-9427", "tags": ["vdb-entry", "x_refsource_REDHAT"]}, {"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2316047", "name": "RHBZ#2316047", "tags": ["issue-tracking", "x_refsource_REDHAT"]}], "descriptions": [{"lang": "en", "value": "A vulnerability in Koji was found. An unsanitized input allows for an XSS attack. Javascript code from a malicious link could be reflected in the resulting web page. It is not expected to be able to submit an action or make a change in Koji due to existing XSS protections in the code"}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-116", "description": "Improper Encoding or Escaping of Output"}]}], "providerMetadata": {"orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "shortName": "redhat", "dateUpdated": "2025-08-30T21:00:59.012Z"}, "x_redhatCweChain": "CWE-116: Improper Encoding or Escaping of Output"}}, "cveMetadata": {"cveId": "CVE-2024-9427", "state": "PUBLISHED", "dateUpdated": "2025-08-30T21:00:59.012Z", "dateReserved": "2024-10-02T02:30:27.642Z", "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "datePublished": "2024-12-24T03:25:27.815Z", "assignerShortName": "redhat"}, "dataVersion": "5.1"}

{"cveTags": [], "descriptions": [{"lang": "en", "value": "A vulnerability in Koji was found. An unsanitized input allows for an XSS attack. Javascript code from a malicious link could be reflected in the resulting web page. It is not expected to be able to submit an action or make a change in Koji due to existing XSS protections in the code"}, {"lang": "es", "value": "Se encontr\u00f3 una vulnerabilidad en Koji. Una entrada no desinfectada permite un ataque XSS. El c\u00f3digo Javascript de un enlace malicioso podr\u00eda reflejarse en la p\u00e1gina web resultante. No se espera poder enviar una acci\u00f3n o realizar un cambio en Koji debido a las protecciones XSS existentes en el c\u00f3digo."}], "id": "CVE-2024-9427", "lastModified": "2025-02-07T05:15:12.130", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 2.5, "source": "secalert@redhat.com", "type": "Secondary"}]}, "published": "2024-12-24T04:15:07.360", "references": [{"source": "secalert@redhat.com", "url": "https://access.redhat.com/security/cve/CVE-2024-9427"}, {"source": "secalert@redhat.com", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2316047"}], "sourceIdentifier": "secalert@redhat.com", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-116"}], "source": "secalert@redhat.com", "type": "Secondary"}]}

{}