Threats tagged 'ghsa-m857-xf4f-qjf2'

Mythic versions 3.2.16 through 3.4.0.61 have a stored cross-site scripting (XSS) vulnerability. Attackers who control target endpoint files can embed malicious HTML in files named with a .pdf extension. When an operator previews such a file in the Mythic UI, the malicious content executes JavaScript in the same origin, allowing theft of localStorage JWT tokens. These tokens grant full GraphQL and REST API access.