Fathom
Monthly
Stored cross-site scripting in Fathom Lite through 1.3.1 permits unauthenticated attackers to poison the operator's Top Pages dashboard by submitting a crafted javascript: URI to the public /collect analytics endpoint, ultimately enabling session hijacking and full account takeover. The parseHostname and parsePathname functions perform no URI scheme validation, so a javascript: hostname combined with a newline-prefixed pathname is stored verbatim and later rendered as an unsanitized anchor href in the authenticated dashboard. A publicly available exploit demonstrates the full attack chain; while no CISA KEV listing is present, the zero-authentication injection barrier and realistic operator-click trigger make real-world impact materially higher than the CVSS 4.0 score of 5.1 suggests.
Fathom 2.4 contains a buffer overflow vulnerability in the Authorization Code field that allows local attackers to crash the application by submitting an oversized input string. Rated medium severity (CVSS 6.8), this vulnerability is no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Stored cross-site scripting in Fathom Lite through 1.3.1 permits unauthenticated attackers to poison the operator's Top Pages dashboard by submitting a crafted javascript: URI to the public /collect analytics endpoint, ultimately enabling session hijacking and full account takeover. The parseHostname and parsePathname functions perform no URI scheme validation, so a javascript: hostname combined with a newline-prefixed pathname is stored verbatim and later rendered as an unsanitized anchor href in the authenticated dashboard. A publicly available exploit demonstrates the full attack chain; while no CISA KEV listing is present, the zero-authentication injection barrier and realistic operator-click trigger make real-world impact materially higher than the CVSS 4.0 score of 5.1 suggests.
Fathom 2.4 contains a buffer overflow vulnerability in the Authorization Code field that allows local attackers to crash the application by submitting an oversized input string. Rated medium severity (CVSS 6.8), this vulnerability is no authentication required, low attack complexity. Public exploit code available and no vendor patch available.