Vulnerability · Published Oct 3, 2024 · Assigned by GitHub_M
CVE-2024-47617Reflected XSS Vulnerability in Sulu Media Bundle
Medium 6.1
In plain English
A medium-severity cross-site scripting in sulu from sulu. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 34% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
Sulu is a PHP content management system. This vulnerability allows an attacker to inject arbitrary HTML/JavaScript code through the media download URL in Sulu CMS. It affects the SuluMediaBundle component. The vulnerability is a Reflected Cross-Site Scripting (XSS) issue, which could potentially allow attackers to steal sensitive information, manipulate the website's content, or perform actions on behalf of the victim. This vulnerability is fixed in 2.6.5 and 2.5.21.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Packagist | sulu/sulu | 2.6.5 | GHSA-6784-9c82-vr85 |
| Packagist | sulu/sulu | 2.5.21 | GHSA-6784-9c82-vr85 |
Affected products (as reported)
Weakness: CWE-79 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N