CVE-2024-29896
CVSS 3.1 Score 7.5 of 10 (high)
Details
Summary
CVE-2024-29896 is a vulnerability affecting the Astro-Shield library, which is used to compute subresource integrity hashes for JavaScript scripts and CSS stylesheets. When automatic CSP (Content Security Policy) headers generation for Server-Side Rendered (SSR) content is enabled, this vulnerability can lead to the allow-listing of malicious injected resources, such as inlined JavaScript or external malicious scripts. This issue can be exploited if the web application serves content that can be partially controlled by external users. The recommended solution is to upgrade to version 1.3.0 of the library to mitigate this vulnerability.
Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.