Vulnerability · Published Nov 8, 2024 · Assigned by GitHub_M

CVE-2024-52004Remote code execution vulnerabilities in MediaCMS

High 8.7

In plain English

A high-severity injection in mediacms from mediacms-io. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.7% (higher than 54% of all known vulnerabilities).

Severity (CVSS 4.0)8.7High

Exploit odds (30 days)0.7%top 46.4% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

MediaCMS is an open source video and media CMS, written in Python/Django and React, featuring a REST API. MediaCMS has been prone to vulnerabilities that upon special cases can lead to remote code execution. All versions before v4.1.0 are susceptible, and users are highly recommended to upgrade. The vulnerabilities are related with insufficient input validation while uploading media content. The condition to exploit the vulnerability is that the portal allows users to upload content. This issue has been patched in version 4.1.0. There are no known workarounds for this vulnerability.

Affected products (as reported)

Vendor	Product	Versions
mediacms-io	mediacms	< 4.1.0

Weakness: CWE-74 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

References

https://github.com/mediacms-io/mediacms/security/advisories/GHSA-x3p4-4442-q2c3 x_refsource_CONFIRM
https://github.com/mediacms-io/mediacms/blob/main/docs/admins_docs.md x_refsource_MISC