PT-2024-16798 · Publiccms · Publiccms

Glno · Published 2024-11-13 · Updated 2024-11-17 · CVE-2024-11175

Positive Technologies (AI Summary)

CVSS v3.1

4.8

Medium

Base vector

AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Public CMS version 5.202406.d

Description A vulnerability was found in the Voting Management component of Public CMS, affecting the file /admin/cmsVote/save. This issue leads to cross-site scripting and can be initiated remotely.

Recommendations Apply the patch b9530b9cc1f5cfdad4b637874f59029a6283a65c to fix this issue. As a temporary workaround, consider restricting access to the /admin/cmsVote/save file until the patch is applied.

Exploit

Fix

XSS

Code Injection

Weakness Enumeration

CWE-79

CWE-94

Related Identifiers

CVE-2024-11175

Affected Products

Publiccms

References · 18

• 🔥 https://gitee.com/sanluan/PublicCMS/issues/IB2BUV · Exploit
• https://gitee.com/sanluan/PublicCMS/commit/b9530b9cc1f5cfdad4b637874f59029a6283a65c · Patch
• https://osv.dev/vulnerability/CVE-2024-11175 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-11175 · Security Note
• https://twitter.com/transilienceai/status/1858016733769892025 · Twitter Post
• https://twitter.com/transilienceai/status/1858016714551685278 · Twitter Post
• https://t.me/cvedetector/10845 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1856790263575785771 · Twitter Post
• https://twitter.com/transilienceai/status/1858016766317719693 · Twitter Post
• https://vuldb.com/?ctiid.284351 · Note
• https://vuldb.com/?id.284351 · Note
• https://twitter.com/transilienceai/status/1858016749280448844 · Twitter Post
• https://twitter.com/transilienceai/status/1858016728308969623 · Twitter Post
• https://twitter.com/transilienceai/status/1858016760991039536 · Twitter Post
• https://twitter.com/transilienceai/status/1858016754833744372 · Twitter Post