PT-2024-29666 · Kirby · Kirby

Sebastianeberlein-Juno · Published 2024-08-29 · Updated 2024-09-06 · CVE-2024-41964

Positive Technologies (AI Summary)

CVSS v4.0

8.8

High

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Kirby versions prior to 3.6.6.6 Kirby versions prior to 3.7.5.5 Kirby versions prior to 3.8.4.4 Kirby versions prior to 3.9.8.2 Kirby versions prior to 3.10.1.1 Kirby versions prior to 4.3.1

Description Kirby is a CMS targeting designers and editors, allowing the restriction of permissions for specific user roles. However, permission checks for creating, deleting, and updating languages were not enforced, enabling attackers with Panel access to manipulate language definitions. This could lead to significant damage, such as content loss, site availability issues, or integrity problems due to changed URLs or removed translations.

Recommendations For Kirby versions prior to 3.6.6.6, update to version 3.6.6.6 or later. For Kirby versions prior to 3.7.5.5, update to version 3.7.5.5 or later. For Kirby versions prior to 3.8.4.4, update to version 3.8.4.4 or later. For Kirby versions prior to 3.9.8.2, update to version 3.9.8.2 or later. For Kirby versions prior to 3.10.1.1, update to version 3.10.1.1 or later. For Kirby versions prior to 4.3.1, update to version 4.3.1 or later.

Exploit

Fix

Incorrect Authorization

Weakness Enumeration

CWE-863

Related Identifiers

CVE-2024-41964

GHSA-JM9M-RQR3-WFMH

Affected Products

Kirby

References · 22

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/41xxx/CVE-2024-41964.json · Exploit
• https://github.com/getkirby/kirby/security/advisories/GHSA-jm9m-rqr3-wfmh · Vendor Advisory
• https://github.com/getkirby/kirby/commit/ab95d172667c3cd529917c2bc94d3c7969706d23 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2024-41964 · Security Note
• https://osv.dev/vulnerability/GHSA-jm9m-rqr3-wfmh · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-41964 · Vendor Advisory
• https://github.com/getkirby/kirby · Note
• https://github.com/getkirby/kirby/commit/1dbc9215c97a5c22dc7f34a4e3a64d19e1eac151 · Note
• https://github.com/getkirby/kirby/releases/tag/3.6.6.6 · Note
• https://github.com/getkirby/kirby/releases/tag/3.9.8.2 · Note
• https://github.com/getkirby/kirby/releases/tag/3.8.4.4 · Note
• https://github.com/getkirby/kirby/releases/tag/3.7.5.5 · Note
• https://github.com/getkirby/kirby/commit/af9b0a58dea63effab85525ae217faa1f5ded423 · Note
• https://github.com/getkirby/kirby/commit/83fce501759782cf843b6f1d9293a7c7167e69af · Note
• https://github.com/getkirby/kirby/releases/tag/4.3.1 · Note