CVE-2024-49378
MEDIUMsmartUp 7.2.622.1170 - Universal Cross-Site Scripting
Title source: llmDescription
smartUp, a web browser mouse gestures extension, has a universal cross-site scripting issue in the Edge and Firefox versions of smartUp 7.2.622.1170. The vulnerability allows another extension to execute arbitrary code in the context of the user’s tab. As of time of publication, no known patches exist.
References (2)
Core 2
Core References
Various Sources x_refsource_confirm
https://securitylab.github.com/advisories/GHSL-2024-011_smartup/
Various Sources x_refsource_misc
https://github.com/zimocode/smartup/blob/2144ec161697751b1a6702f1af866726ea689e4e/js/background.js#L3800
Scores
CVSS v3
6.1
EPSS
0.0031
EPSS Percentile
22.8%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:L
CISA SSVC
Vulnrichment
Exploitation
poc
Automatable
no
Technical Impact
partial
Details
CWE
CWE-79
Status
published
Products (1)
zimocode/smartup
<= 7.2.622.1170
Published
Oct 25, 2024
Tracked Since
Feb 18, 2026