PT-2024-36509 · Unknown · Piranha Cms

Published 2024-12-20 · Updated 2025-04-21 · CVE-2024-55341

Positive Technologies (AI Summary)

CVSS v3.1

4.7

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Piranha CMS version 11.1

Description A stored cross-site scripting (XSS) vulnerability allows remote attackers to execute arbitrary JavaScript in the web browser of a user. This is achieved by creating a page via the "/manager/pages" endpoint and then adding markdown content with the XSS payload.

Recommendations For Piranha CMS version 11.1, as a temporary workaround, consider restricting access to the "/manager/pages" endpoint to minimize the risk of exploitation. Additionally, avoid using markdown content that may contain XSS payloads until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2024-55341

GHSA-MMX8-VRFG-HFMQ

Affected Products

Piranha Cms

References · 10

• 🔥 https://sec-fortress.github.io/posts/articles/posts/CVE-2024-55341.html · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2024-55341 · Security Note
• https://osv.dev/vulnerability/CVE-2024-55341 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-mmx8-vrfg-hfmq · Vendor Advisory
• https://github.com/PiranhaCMS/piranha.core · Note
• https://twitter.com/CVEnew/status/1870191485301166315 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1870216257724694829 · Twitter Post
• https://t.me/cvenotify/119194 · Telegram Post
• https://t.me/cvenotify/105204 · Telegram Post
• https://t.me/cvedetector/13457 · Telegram Post