Lucene search
K
Database
Vendors
Products
Years
CVSS
Scanner
Agent Scanning
API Scanning
Manual Audit
Perimeter Scanner
Scanning
Projects
Email
Webhook
Plugins
Resources
Documents
Blog
Glossary
FAQ
Pricing
Contacts
About Us
Partners
Branding Guideline
githubGitHub Advisory DatabaseGHSA-J5G9-J7R4-6QVX
HistoryJan 03, 2024 - 9:50 p.m.

Craft CMS Privilege Escalation

2024-01-0321:50:26
CWE-269
GitHub Advisory Database
github.com
10
craft cms
privilege escalation
vulnerability
user permissions
patched

8.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

7.4 High

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

31.9%

JSON

Impact

This is a potential moderate impact, low complexity privilege escalation vulnerability in Craft with certain user permissions setups.

Patches

This has been fixed in Craft 4.4.16 and Craft 3.9.6. Users should ensure they are running at least those versions.

References

https://github.com/craftcms/cms/pull/13932
https://github.com/craftcms/cms/pull/13931
https://github.com/craftcms/cms/blob/develop/CHANGELOG.md#4511---2023-11-16
https://github.com/craftcms/cms/blob/v3/CHANGELOG.md#396---2023-11-16

Affected configurations

Vulners
Node
craftcmscraft_cmsRange≤3.9.5
OR
craftcmscraft_cmsRange≤4.5.10
CPENameOperatorVersion
craftcms/cmsle3.9.5
craftcms/cmsle4.5.10

Related

cvelist 1
osv 2
nvd 1
prion 1
veracode 1
cve 1
cvelist
cvelist
CVE-2024-21622 Craft CMS Privilege Escalation
2024-01-03 16:51:25
osv
osv
Craft CMS Privilege Escalation
2024-01-03 21:50:26
CVE-2024-21622
2024-01-03 17:15:12
nvd
nvd
CVE-2024-21622
2024-01-03 17:15:12
prion
prion
Privilege escalation
2024-01-03 17:15:00
veracode
veracode
Privilege Escalation
2024-01-04 07:57:46
cve
cve
CVE-2024-21622
2024-01-03 17:15:12

8.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

7.4 High

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

31.9%

JSON
Related for GHSA-J5G9-J7R4-6QVX
cvelist1osv2nvd1prion1veracode1cve1