CVE-2024-5737
6.3 Medium
CVSS4
Attack Vector
NETWORK
Attack Complexity
HIGH
Privileges Required
NONE
User Interaction
NONE
CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/SC:N/VI:L/SI:N/VA:L/SA:N/AU:Y/U:Green/R:U/V:D/RE:L
6.5 Medium
AI Score
Confidence
High
0.0004 Low
EPSS
Percentile
15.7%
Script afGdStream.php in AdmirorFrames Joomla! extension doesn’t specify a content type and as a result default (text/html) is used. An attacker may embed HTML tags directly in image data which is rendered by a webpage as HTML. This issue affects AdmirorFrames: before 5.0.
CNA Affected
[
{
"collectionURL": "https://www.admiror-design-studio.com/admiror-joomla-extensions/admiror-frames",
"defaultStatus": "unaffected",
"platforms": [
"Joomla!"
],
"product": "AdmirorFrames",
"repo": "https://github.com/vasiljevski/admirorframes",
"vendor": "Nikola Vasilijevski",
"versions": [
{
"lessThan": "5.0",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
]Related
6.3 Medium
CVSS4
Attack Vector
NETWORK
Attack Complexity
HIGH
Privileges Required
NONE
User Interaction
NONE
CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/SC:N/VI:L/SI:N/VA:L/SA:N/AU:Y/U:Green/R:U/V:D/RE:L
6.5 Medium
AI Score
Confidence
High
0.0004 Low
EPSS
Percentile
15.7%