CVE-2024-47617

Sulu is a PHP content management system. This vulnerability allows an attacker to inject arbitrary HTML/JavaScript code through the media download URL in Sulu CMS. It affects the SuluMediaBundle component. The vulnerability is a Reflected Cross-Site Scripting (XSS) issue, which could potentially allow attackers to steal sensitive information, manipulate the website's content, or perform actions on behalf of the victim. This vulnerability is fixed in 2.6.5 and 2.5.21.
Configurations

Configuration 1 (hide)

OR cpe:2.3:a:sulu:sulu:2.5.20:*:*:*:*:*:*:*
cpe:2.3:a:sulu:sulu:2.6.4:*:*:*:*:*:*:*

History

08 Oct 2024, 14:23

Type Values Removed Values Added
First Time Sulu sulu
Sulu
CPE cpe:2.3:a:sulu:sulu:2.6.4:*:*:*:*:*:*:*
cpe:2.3:a:sulu:sulu:2.5.20:*:*:*:*:*:*:*
References () https://github.com/sulu/sulu/commit/a5a5ae555d282e88ff8559d38cfb46dea7939bda - () https://github.com/sulu/sulu/commit/a5a5ae555d282e88ff8559d38cfb46dea7939bda - Product
References () https://github.com/sulu/sulu/commit/eeacd14b6cf55f710084788140d40ebb00314b29 - () https://github.com/sulu/sulu/commit/eeacd14b6cf55f710084788140d40ebb00314b29 - Patch
References () https://github.com/sulu/sulu/security/advisories/GHSA-6784-9c82-vr85 - () https://github.com/sulu/sulu/security/advisories/GHSA-6784-9c82-vr85 - Vendor Advisory

04 Oct 2024, 13:50

Type Values Removed Values Added
Summary
  • (es) Sulu es un sistema de gestión de contenido PHP. Esta vulnerabilidad permite a un atacante inyectar código HTML/JavaScript arbitrario a través de la URL de descarga de medios en Sulu CMS. Afecta al componente SuluMediaBundle. La vulnerabilidad es un problema de Cross-Site Scripting (XSS) Reflejado, que podría permitir a los atacantes robar información confidencial, manipular el contenido del sitio web o realizar acciones en nombre de la víctima. Esta vulnerabilidad se ha corregido en las versiones 2.6.5 y 2.5.21.

03 Oct 2024, 15:15

Type Values Removed Values Added
New CVE

Information

Published : 2024-10-03 15:15

Updated : 2024-10-08 14:23


NVD link : CVE-2024-47617

Mitre link : CVE-2024-47617

CVE.ORG link : CVE-2024-47617


JSON object : View

Products Affected

sulu

  • sulu
CWE
CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')