PT-2024-29454 · Unknown · Processwire

Published 2024-07-19 · Updated 2024-08-01 · CVE-2024-41597

Positive Technologies (AI Summary)

CVSS v3.1

4.2

Medium

Base vector

AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions ProcessWire version 3.0.229

Description A Cross Site Request Forgery issue allows a remote attacker to execute arbitrary code via a crafted HTML file to the comments functionality.

Recommendations For version 3.0.229, update to a newer version that contains a fix for this issue, as using a crafted HTML file can lead to arbitrary code execution.

Exploit

Fix

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2024-41597

GHSA-R9VW-CJF9-XH4X

Affected Products

Processwire

References · 6

• 🔥 https://gist.github.com/DefensiumDevelopers/608be4d10b016dce0566925368a8b08c#file-cve-2024-41597-md · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2024-41597 · Security Note
• https://osv.dev/vulnerability/CVE-2024-41597 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-r9vw-cjf9-xh4x · Vendor Advisory
• https://github.com/processwire/processwire · Note
• https://t.me/cvedetector/1232 · Telegram Post