-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability allows authenticated users to upload malicious SVG images, leading to a stored Cross-Site Scripting (XSS) vulnerability. The provided commit b2ae6f92d12206ea185a2e882945a6b69234bf03 directly addresses this issue. The patch modifies the downloadIfChanged method within the ImageController.java file. Specifically, it adds a Content-Security-Policy header with the value default-src 'none' to the HTTP response when an image is served. This change prevents the browser from executing any embedded scripts within the SVG file, thus neutralizing the XSS threat. The location of the patch pinpoints org.thingsboard.server.controller.ImageController.downloadIfChanged as the function responsible for serving the vulnerable content without proper security controls.
org.thingsboard.server.controller.ImageController.downloadIfChangedapplication/src/main/java/org/thingsboard/server/controller/ImageController.java
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| org.thingsboard:application | maven | < 4.2.1 | 4.2.1 |