Lucene search

GitHub_MCVE-2024-45406

HistorySep 09, 2024 - 5:15 p.m.

CVE-2024-45406

2024-09-0917:15:13

CWE-79

CWE-80

GitHub_M

web.nvd.nist.gov

craft cms

xss vulnerability

breadcrumb list

title fields

CVSS3

5.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

LOW

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L

EPSS

Percentile

14.7%

JSON

Craft is a content management system (CMS). Craft CMS 5 stored XSS can be triggered by the breadcrumb list and title fields with user input.

Affected configurations

Nvd

Vulners

Vulnrichment

Node

craftcmscraft_cmsRange5.0.0–5.1.2

VendorProductVersionCPE
craftcmscraft_cms*cpe:2.3:a:craftcms:craft_cms:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
craftcms	craft_cms	*	cpe:2.3:a:craftcms:craft_cms::::::::

CNA Affected

[
  {
    "vendor": "craftcms",
    "product": "cms",
    "versions": [
      {
        "version": ">= 5.0.0, < 5.1.2",
        "status": "affected"
      }
    ]
  }
]

References

github.com/craftcms/cms/commit/b7348942f8131b3868ec6f46d615baae50151bb8

github.com/craftcms/cms/security/advisories/GHSA-28h4-788g-rh42