GitHub Advisoryadvisory · Packagist

GHSA-255w-87rh-rg44 Cross-site Scripting via uploaded SVG

MEDIUM Published 2024-10-03 Modified 2024-10-18 Official page ↗
Aliases
CVE-2024-47618
Ecosystem
Packagist
Packages
sulu/sulu
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Weaknesses
CWE-79
Reviewed
2024-10-03

Affected packages

• Packagist sulu/sulu: >= 2.0.0-RC1, < 2.5.21 → fixed in 2.5.21 • Packagist sulu/sulu: >= 2.6.0-RC1, < 2.6.5 → fixed in 2.6.5

Description

In Sulu v2.0.0 through v2.6.4 are vulnerable against XSS whereas a low privileged user with an access to the “Media” section can upload an SVG file with a malicious payload. Once uploaded and accessed, the malicious javascript will be executed on the victims’ (other users including admins) browsers.

Related

Alias · CVE (1)

  • CVE-2024-47618 Sulu is a PHP content management system. vulnerability

Weakness · CWE (1)

  • CWE-79 Improper Neutralization of Input During Web Page Generation weakness

References