CVE-2024-8370 | Grocy up to 4.2.0 SVG File Upload recipepictures force_serve_as cross site scripting

CVE-2024-8370 | Grocy up to 4.2.0 SVG File Upload recipepictures force_serve_as cross site scripting

A vulnerability classified as problematic was found in Grocy up to 4.2.0. This vulnerability affects unknown code of the file /api/files/recipepictures/ of the component SVG File Upload Handler. The manipulation of the argument force_serve_as with the input picture' leads to cross site scripting. This vulnerability was named CVE-2024-8370. The attack can be initiated remotely. Furthermore, there is an exploit available. The real existence of this vulnerability is still doubted at the moment. The project maintainer explains that "this is 'nonsense' and practically irrelevant according to the project's security policy" which expects additional authentication for the software.