An HTML injection vulnerability in Vaultwarden prior to v1.32.5 allows attackers to execute arbitrary code via injecting a crafted payload into the username field of an e-mail message.
CVSS
No CVSS.
References
| Link | Resource |
|---|---|
| https://github.com/dani-garcia/vaultwarden/releases/tag/1.32.4 | Release Notes |
| https://github.com/dani-garcia/vaultwarden/releases/tag/1.32.5 | Release Notes |
| https://insinuator.net/2024/11/vulnerability-disclosure-authentication-bypass-in-vaultwarden-versions-1-32-5/ | Third Party Advisory Exploit |
Configurations
History
20 Jun 2025, 18:30
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://insinuator.net/2024/11/vulnerability-disclosure-authentication-bypass-in-vaultwarden-versions-1-32-5/ - Third Party Advisory, Exploit | |
| References | () https://github.com/dani-garcia/vaultwarden/releases/tag/1.32.5 - Release Notes | |
| References | () https://github.com/dani-garcia/vaultwarden/releases/tag/1.32.4 - Release Notes | |
| First Time |
Dani-garcia vaultwarden
Dani-garcia |
|
| CPE | cpe:2.3:a:dani-garcia:vaultwarden:*:*:*:*:*:*:*:* |
09 Jan 2025, 21:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2025-01-09 21:15
Updated : 2025-06-20 18:30
NVD link : CVE-2024-55224
Mitre link : CVE-2024-55224
JSON object : View
Products Affected
dani-garcia
- vaultwarden
CWE
No CWE.