Vulnerability · Published Feb 5, 2024 · Assigned by GitHub_M

CVE-2024-24807Sulu is vulnerable to HTML Injection via Autocomplete Suggestion

Low 2.7

In plain English

A low-severity security flaw in sulu from sulu. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 44% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)2.7Low

Exploit odds (30 days)0.5%top 55.8% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Sulu is a highly extensible open-source PHP content management system based on the Symfony framework. There is an issue when inputting HTML into the Tag name. The HTML is executed when the tag name is listed in the auto complete form. Only admin users can create tags so they are the only ones affected. The problem is patched with version(s) 2.4.16 and 2.5.12.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Packagist	sulu/sulu	2.4.16	GHSA-gfrh-gwqc-63cv
Packagist	sulu/sulu	2.5.12	GHSA-gfrh-gwqc-63cv

Affected products (as reported)

Vendor	Product	Versions
sulu	sulu	>= 2.0.0, < 2.4.16>= 2.5.0, < 2.5.12

Weakness: CWE-80 · Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N

References

https://github.com/sulu/sulu/security/advisories/GHSA-gfrh-gwqc-63cv x_refsource_CONFIRM
https://github.com/sulu/sulu/releases/tag/2.4.16 x_refsource_MISC
https://github.com/sulu/sulu/releases/tag/2.5.12 x_refsource_MISC