CVE-2024-32472

{
  "id": "CVE-2024-32472",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2024-32472",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2024-07-26T15:06:18.717604Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "security-advisories@github.com",
        "cvssData": {
          "scope": "CHANGED",
          "version": "3.1",
          "baseScore": 6.1,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
          "integrityImpact": "LOW",
          "userInteraction": "REQUIRED",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "LOW"
        },
        "impactScore": 2.7,
        "exploitabilityScore": 2.8
      }
    ]
  },
  "affected": [
    {
      "source": "security-advisories@github.com",
      "affectedData": [
        {
          "vendor": "excalidraw",
          "product": "excalidraw",
          "versions": [
            {
              "status": "affected",
              "version": ">=0.16.0, <0.16.4"
            },
            {
              "status": "affected",
              "version": ">= 0.17.0, <0.17.6"
            }
          ]
        }
      ]
    },
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "affectedData": [
        {
          "cpes": [
            "cpe:2.3:a:excalidraw:excalidraw:*:*:*:*:*:*:*:*"
          ],
          "vendor": "excalidraw",
          "product": "excalidraw",
          "versions": [
            {
              "status": "affected",
              "version": "0.16.0",
              "lessThan": "0.16.4",
              "versionType": "custom"
            },
            {
              "status": "affected",
              "version": "0.17.0",
              "lessThan": "0.17.6",
              "versionType": "custom"
            }
          ],
          "defaultStatus": "unknown"
        }
      ]
    }
  ],
  "published": "2024-04-17T22:15:08.557",
  "references": [
    {
      "url": "https://github.com/excalidraw/excalidraw/commit/6be752e1b6d776ccfbd3bb9eea17463cb264121d",
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/excalidraw/excalidraw/commit/988f81911ca58e3ca2583e0dd44a954dd00e09d0",
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/excalidraw/excalidraw/security/advisories/GHSA-m64q-4jqh-f72f",
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/excalidraw/excalidraw/commit/6be752e1b6d776ccfbd3bb9eea17463cb264121d",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://github.com/excalidraw/excalidraw/commit/988f81911ca58e3ca2583e0dd44a954dd00e09d0",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://github.com/excalidraw/excalidraw/security/advisories/GHSA-m64q-4jqh-f72f",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "security-advisories@github.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-79"
        },
        {
          "lang": "en",
          "value": "CWE-80"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "excalidraw is an open source virtual hand-drawn style whiteboard. A stored XSS vulnerability in Excalidraw's web embeddable component. This allows arbitrary JavaScript to be run in the context of the domain where the editor is hosted. There were two vectors. One rendering untrusted string as iframe's `srcdoc` without properly sanitizing against HTML injection. Second by improperly sanitizing against attribute HTML injection. This in conjunction with allowing `allow-same-origin` sandbox flag (necessary for several embeds) resulted in the XSS. This vulnerability is fixed in 0.17.6 and 0.16.4."
    },
    {
      "lang": "es",
      "value": "excalidraw es una pizarra virtual de código abierto dibujada a mano. Una vulnerabilidad XSS almacenada en el componente web integrable de Excalidraw. Esto permite ejecutar JavaScript arbitrario en el contexto del dominio donde está alojado el editor. Había dos vectores. Uno que representa una cadena que no es de confianza como `srcdoc` de iframe sin desinfectar adecuadamente contra la inyección de HTML. En segundo lugar, mediante una desinfección inadecuada contra la inyección de atributos HTML. Esto, junto con permitir el indicador de zona de pruebas \"permitir el mismo origen\" (necesario para varias incrustaciones), dio como resultado el XSS. Esta vulnerabilidad se solucionó en 0.17.6 y 0.16.4."
    }
  ],
  "lastModified": "2026-06-17T07:29:41.680",
  "sourceIdentifier": "security-advisories@github.com"
}