CVE-2024-6449 - CVE House
Back to Database
Status published Medium CVE-2024-6449

Arbitrary cross-domain file inclusion in HyperView Geoportal Toolkit

Vulnerability Description

HyperView Geoportal Toolkit in versions lower than 8.5.0 does not restrict cross-domain requests when fetching remote content pointed by one of GET request parameters. An unauthenticated remote attacker can prepare links, which upon opening will load scripts from a remote location controlled by the attacker and execute them in the user space. By manipulating this parameter it is also possible to enumerate some of the devices in Local Area Network in which the server resides.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2024-6449

Credits & Attribution

The following person or organization is credited with identifying this vulnerability, as recorded in the NVD database:

  • Dariusz Gońda

References

More from HyperView

View All →
CVE-2024-6450
Reflected XSS in HyperView Geoportal Toolkit
Medium 5.3

Affected Vendor

Affected Software

Geoportal Toolkit
Vulnerable Versions:
0

Timeline

Official Publish: August 28th, 2024
Last Modified: January 9th, 2025
Added to House: July 22nd, 2026

CVSS Vectors

Weaknesses (CWE)

CWE-942

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.