PT-2024-34158 · Unknown · Instantcms

Amal264882 · Published 2024-10-29 · Updated 2025-02-14 · CVE-2024-50348

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions: InstantCMS versions prior to 2.16.3

Description: The issue is related to a lack of input validation in the photo upload function on the photo album page, allowing attackers to inject and execute Cross Site Scripting (XSS) payloads.

Recommendations: For versions prior to 2.16.3, update to version 2.16.3 to resolve the issue. As a temporary workaround, consider disabling the photo upload function in the photo album page until the update is applied. Restrict access to the photo album page to minimize the risk of exploitation.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2024-50348

GHSA-F6CF-JG84-FW29

Affected Products

Instantcms

References · 9

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/50xxx/CVE-2024-50348.json · Exploit
• 🔥 https://github.com/instantsoft/icms2/security/advisories/GHSA-f6cf-jg84-fw29 · Exploit
• https://github.com/instantsoft/icms2/commit/e02de2fa1850bb40c9b2050b9256c838a0ea7aa3 · Patch
• https://osv.dev/vulnerability/CVE-2024-50348 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-50348 · Security Note
• https://t.me/cvedetector/9383 · Telegram Post
• https://t.me/cvenotify/100800 · Telegram Post
• https://t.me/cvenotify/99978 · Telegram Post
• https://twitter.com/getastra/status/1890405848419066210 · Twitter Post