PT-2024-28442 · Ibexa · Ibexa Admin Ui Bundle

4Rdr · Published 2024-07-31 · Updated 2024-08-01 · CVE-2024-39318

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Ibexa Admin UI Bundle (affected versions not specified)

Description The file upload widget in the Ibexa Admin UI Bundle is vulnerable to XSS payloads in filenames. Access permission to upload files is required, which is typically only granted to authenticated editors and administrators. The vulnerability is not persistent, meaning the payload is only executed during the upload, and an attacker would need to trick an editor or administrator into uploading a file with a malicious filename.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2024-39318

GHSA-GC5H-6JX9-Q2QH

GHSA-QM44-WJM2-PR59

Affected Products

Ibexa Admin Ui Bundle

References · 15

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/39xxx/CVE-2024-39318.json · Exploit
• https://osv.dev/vulnerability/CVE-2024-39318 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-39318 · Security Note
• https://osv.dev/vulnerability/GHSA-gc5h-6jx9-q2qh · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-qm44-wjm2-pr59 · Vendor Advisory
• https://github.com/ezsystems/ezplatform-admin-ui/security/advisories/GHSA-gc5h-6jx9-q2qh · Note
• https://github.com/ezsystems/ezplatform-admin-ui/commit/7a9f991b200fa5a03d49cd07f50577c8bc90a30b · Note
• https://github.com/ezsystems/ezplatform-admin-ui · Note
• https://github.com/ibexa/admin-ui · Note
• https://github.com/ibexa/admin-ui/commit/8dc413fad1045fcfbe65dbcb0bea8516accc4c3e · Note
• https://github.com/ibexa/admin-ui/security/advisories/GHSA-qm44-wjm2-pr59 · Note
• https://developers.ibexa.co/security-advisories/ibexa-sa-2024-004-dom-based-xss-in-file-upload · Note
• https://t.me/cvenotify/88203 · Telegram Post
• https://t.me/cvenotify/88085 · Telegram Post
• https://t.me/cvedetector/2152 · Telegram Post