PT-2024-35962 · Ibexa · Ibexa Admin Ui Bundle

Published 2024-11-29 · Updated 2024-12-02 · CVE-2024-53864

Positive Technologies (AI Summary)

CVSS v4.0

5.3

Medium

Base vector

AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Name of the Vulnerable Software and Affected Versions: Ibexa Admin UI Bundle versions prior to 4.6.14

Description: A Cross-Site Scripting (XSS) vulnerability has been found in the Content name pattern mechanism of the Ibexa Admin UI Bundle. This issue can be exploited if an attacker has Content edit permission. After the fix, any existing injected XSS will not run.

Recommendations: For versions prior to 4.6.14, upgrade to version 4.6.14 or later to resolve the issue. As a temporary workaround, consider restricting Content edit permissions to minimize the risk of exploitation.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2024-53864

GHSA-8W3P-GF85-QCCH

Affected Products

Ibexa Admin Ui Bundle

References · 11

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/53xxx/CVE-2024-53864.json · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2024-53864 · Security Note
• https://osv.dev/vulnerability/GHSA-8w3p-gf85-qcch · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-53864 · Vendor Advisory
• https://github.com/ibexa/admin-ui · Note
• https://github.com/ibexa/admin-ui/commit/8ec824a8cf06c566ed88e4c21cc66f7ed42649fc · Note
• https://github.com/ibexa/admin-ui/security/advisories/GHSA-8w3p-gf85-qcch · Note
• https://developers.ibexa.co/security-advisories/ibexa-sa-2024-006-vulnerabilities-in-content-name-pattern-commerce-shop-and-varnish-vhost-templates · Note
• https://twitter.com/CVEnew/status/1862570785262424101 · Twitter Post
• https://doc.ibexa.co/en/latest/update_and_migration/from_4.6/update_from_4.6/#v4614 · Note
• https://twitter.com/VulmonFeeds/status/1862836789414596871 · Twitter Post