Vulnerability · Published Aug 23, 2024 · Assigned by mitre
CVE-2024-40111
Medium 4.8
In plain English
A medium-severity cross-site scripting in the automad/automad package (Packagist). Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.8% (higher than 58% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code.
Official description
A persistent (stored) cross-site scripting (XSS) vulnerability has been identified in Automad 2.0.0-alpha.4. This vulnerability enables an attacker to inject malicious JavaScript code into the template body. The injected code is stored within the flat file CMS and is executed in the browser of any user visiting the forum.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Packagist | automad/automad | no fix listed | GHSA-g8h2-j9pm-4xx2 |
Affected products (as reported)
Weakness: CWE-79 · Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N