PT-2024-24931 · Hugo · Hugo

Ejona86 · Published 2024-04-23 · Updated 2024-06-04 · CVE-2024-32875

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Hugo versions 0.123.0 through 0.125.3

Description Hugo is a static site generator where title arguments in Markdown for links and images are not escaped in internal render hooks. This issue impacts Hugo users who have these hooks enabled and do not trust their Markdown content files. The problem is resolved in version 0.125.3.

Recommendations For Hugo versions 0.123.0 through 0.125.3, replace the templates with user-defined templates or disable the internal templates as a workaround until the issue is resolved by updating to version 0.125.3 or later.

Exploit

Fix

XSS

Weakness Enumeration

CWE-80

CWE-79

Related Identifiers

CVE-2024-32875

GHSA-PPF8-HHPP-F5HJ

GO-2024-2747

Affected Products

Hugo

References · 19

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/32xxx/CVE-2024-32875.json · Exploit
• https://osv.dev/vulnerability/UBUNTU-CVE-2024-32875 · Vendor Advisory
• https://ubuntu.com/security/CVE-2024-32875 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-ppf8-hhpp-f5hj · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-32875 · Security Note
• https://osv.dev/vulnerability/GO-2024-2747 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2024-32875 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2024-32875 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2024-32875 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-32875 · Vendor Advisory
• https://github.com/gohugoio/hugo · Note
• https://github.com/gohugoio/hugo/security/advisories/GHSA-ppf8-hhpp-f5hj · Note
• https://github.com/gohugoio/hugo/releases/tag/v0.125.3 · Note
• https://github.com/gohugoio/hugo/commit/15a4b9b33715887001f6eff30721d41c0d4cfdd1 · Note
• https://pkg.go.dev/vuln/GO-2024-2747 · Note