PT-2024-21327 · Unknown · Custom Fields

Jesper Den Boer · Published 2024-07-09 · Updated 2025-04-03 · CVE-2024-26278

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Custom Fields component (affected versions not specified)

Description The issue is related to the Custom Fields component not correctly filtering inputs, which leads to a cross-site scripting (XSS) vector. This means an attacker could potentially inject malicious scripts into the component, affecting the security of the system.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

XSS

Weakness Enumeration

CWE-79

Related Identifiers

BIT-JOOMLA-2024-26278

CVE-2024-26278

Affected Products

Custom Fields

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2024-26278 · Security Note
• https://developer.joomla.org/security-centre/939-20240705-core-xss-in-com-fields-default-field-value.html · Vendor Advisory
• https://osv.dev/vulnerability/BIT-joomla-2024-26278 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-26278 · Vendor Advisory
• https://t.me/cvenotify/86804 · Telegram Post
• https://twitter.com/CVEnew/status/1810716007217975562 · Twitter Post