PT-2024-18974 · Craft · Craft

Johnax0 · CVE-2024-21622 · Published 2024-01-03 · Updated 2024-01-10

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:A/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:L

Name of the Vulnerable Software and Affected Versions Craft versions 3.x prior to 3.9.6 Craft versions 4.x prior to 4.4.16

Description This is a potential moderate impact, low complexity privilege escalation issue in Craft with certain user permissions setups. The issue has been fixed in Craft 4.4.16 and Craft 3.9.6.

Recommendations For Craft versions 3.x prior to 3.9.6, update to at least version 3.9.6 to resolve the issue. For Craft versions 4.x prior to 4.4.16, update to at least version 4.4.16 to resolve the issue.

Exploit

Fix

Improper Privilege Management

Weakness Enumeration

CWE-269

Related Identifiers

CVE-2024-21622

GHSA-J5G9-J7R4-6QVX

Affected Products

Craft

References · 16

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/21xxx/CVE-2024-21622.json · Exploit
• https://github.com/craftcms/cms/commit/76caf9af07d9964be0fd362772223be6a5f5b6aa · Patch
• https://github.com/craftcms/cms/pull/13931 · Patch
• https://github.com/craftcms/cms/security/advisories/GHSA-j5g9-j7r4-6qvx · Vendor Advisory
• https://github.com/craftcms/cms/pull/13932 · Patch
• https://github.com/craftcms/cms/commit/be81eb653d633833f2ab22510794abb6bb9c0843 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2024-21622 · Security Note
• https://osv.dev/vulnerability/GHSA-j5g9-j7r4-6qvx · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-21622 · Vendor Advisory
• https://github.com/craftcms/cms · Note
• https://github.com/craftcms/cms/blob/v3/CHANGELOG.md#396---2023-11-16 · Note
• https://github.com/craftcms/cms/blob/develop/CHANGELOG.md#4511---2023-11-16 · Note
• https://t.me/cvenotify/66940 · Telegram Post
• https://twitter.com/CVEnew/status/1742595162117738748 · Twitter Post
• https://t.me/cibsecurity/74336 · Telegram Post