PT-2024-32677 · Sulu · Sulu

Wachterjohannes · Published 2024-10-03 · Updated 2024-10-08 · CVE-2024-47618

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Sulu versions 2.0.0 through 2.6.4

Description Sulu, a PHP content management system, is vulnerable to XSS attacks. A low-privileged user with access to the "Media" section can upload an SVG file containing a malicious payload. Once uploaded and accessed, the malicious JavaScript will be executed on the victims' browsers, including those of other users and admins.

Recommendations For Sulu versions 2.0.0 through 2.6.4, upgrade to version 2.6.5 to fix the issue. As a temporary workaround, consider restricting access to the "Media" section to prevent low-privileged users from uploading malicious SVG files. Avoid accessing SVG files uploaded by low-privileged users until the issue is resolved.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2024-47618

GHSA-255W-87RH-RG44

Affected Products

Sulu

References · 12

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/47xxx/CVE-2024-47618.json · Exploit
• https://github.com/sulu/sulu/commit/ca72f75eebe41ea7726624d8aea7da6c425f1eb9 · Patch
• https://github.com/sulu/sulu/security/advisories/GHSA-255w-87rh-rg44 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-47618 · Security Note
• https://osv.dev/vulnerability/CVE-2024-47618 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-255w-87rh-rg44 · Vendor Advisory
• https://github.com/sulu/sulu · Note
• https://twitter.com/VulmonFeeds/status/1841883614646030599 · Twitter Post
• https://t.me/cvedetector/6895 · Telegram Post
• https://twitter.com/CVEnew/status/1841849535003337055 · Twitter Post
• https://t.me/cvenotify/97425 · Telegram Post
• https://twitter.com/oktsec/status/1841865328201986374 · Twitter Post