GitHub Advisoryadvisory · Packagist

GHSA-j5g9-j7r4-6qvx Craft CMS Privilege Escalation

MEDIUM Published 2024-01-03 Modified 2024-01-03 Official page ↗
Aliases
CVE-2024-21622
Ecosystem
Packagist
Packages
craftcms/cms
Severity
Moderate
CVSS vector
CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:L
Weaknesses
CWE-269
Reviewed
2024-01-03

Affected packages

• Packagist craftcms/cms: >= 4.0.0-RC1, < 4.5.11 → fixed in 4.5.11 • Packagist craftcms/cms: >= 3.0.0, < 3.9.6 → fixed in 3.9.6

Description

Impact This is a potential moderate impact, low complexity privilege escalation vulnerability in Craft with certain user permissions setups. Patches This has been fixed in Craft 4.4.16 and Craft 3.9.6. Users should ensure they are running at least those versions. References https://github.com/craftcms/cms/pull/13932 https://github.com/craftcms/cms/pull/13931 https://github.com/craftcms/cms/blob/develop/CHANGELOG.md#4511---2023-11-16 https://github.com/craftcms/cms/blob/v3/CHANGELOG.md#396---2023-11-16

Related

Alias · CVE (1)

Weakness · CWE (1)

  • CWE-269 Improper Privilege Management weakness

References