CVE-2024-47617

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2024-47617", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2024-09-27T20:37:22.121Z", "datePublished": "2024-10-03T14:24:44.300Z", "dateUpdated": "2024-10-08T13:33:43.219Z"}, "containers": {"cna": {"title": "Reflected XSS Vulnerability in Sulu Media Bundle", "problemTypes": [{"descriptions": [{"cweId": "CWE-79", "lang": "en", "description": "CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.1, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "version": "3.1"}}], "references": [{"name": "https://github.com/sulu/sulu/security/advisories/GHSA-6784-9c82-vr85", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/sulu/sulu/security/advisories/GHSA-6784-9c82-vr85"}, {"name": "https://github.com/sulu/sulu/commit/a5a5ae555d282e88ff8559d38cfb46dea7939bda", "tags": ["x_refsource_MISC"], "url": "https://github.com/sulu/sulu/commit/a5a5ae555d282e88ff8559d38cfb46dea7939bda"}, {"name": "https://github.com/sulu/sulu/commit/eeacd14b6cf55f710084788140d40ebb00314b29", "tags": ["x_refsource_MISC"], "url": "https://github.com/sulu/sulu/commit/eeacd14b6cf55f710084788140d40ebb00314b29"}], "affected": [{"vendor": "sulu", "product": "sulu", "versions": [{"version": ">= 2.6.4, < 2.6.5", "status": "affected"}, {"version": ">= 2.5.20, < 2.5.21", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2024-10-03T14:24:44.300Z"}, "descriptions": [{"lang": "en", "value": "Sulu is a PHP content management system. This vulnerability allows an attacker to inject arbitrary HTML/JavaScript code through the media download URL in Sulu CMS. It affects the SuluMediaBundle component. The vulnerability is a Reflected Cross-Site Scripting (XSS) issue, which could potentially allow attackers to steal sensitive information, manipulate the website's content, or perform actions on behalf of the victim. This vulnerability is fixed in 2.6.5 and 2.5.21."}], "source": {"advisory": "GHSA-6784-9c82-vr85", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2024-10-03T14:38:49.459437Z", "id": "CVE-2024-47617", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-10-08T13:33:43.219Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-47617", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-10-03T14:38:49.459437Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-10-08T13:33:35.962Z"}}], "cna": {"title": "Reflected XSS Vulnerability in Sulu Media Bundle", "source": {"advisory": "GHSA-6784-9c82-vr85", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 6.1, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}}], "affected": [{"vendor": "sulu", "product": "sulu", "versions": [{"status": "affected", "version": ">= 2.6.4, < 2.6.5"}, {"status": "affected", "version": ">= 2.5.20, < 2.5.21"}]}], "references": [{"url": "https://github.com/sulu/sulu/security/advisories/GHSA-6784-9c82-vr85", "name": "https://github.com/sulu/sulu/security/advisories/GHSA-6784-9c82-vr85", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/sulu/sulu/commit/a5a5ae555d282e88ff8559d38cfb46dea7939bda", "name": "https://github.com/sulu/sulu/commit/a5a5ae555d282e88ff8559d38cfb46dea7939bda", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/sulu/sulu/commit/eeacd14b6cf55f710084788140d40ebb00314b29", "name": "https://github.com/sulu/sulu/commit/eeacd14b6cf55f710084788140d40ebb00314b29", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "Sulu is a PHP content management system. This vulnerability allows an attacker to inject arbitrary HTML/JavaScript code through the media download URL in Sulu CMS. It affects the SuluMediaBundle component. The vulnerability is a Reflected Cross-Site Scripting (XSS) issue, which could potentially allow attackers to steal sensitive information, manipulate the website's content, or perform actions on behalf of the victim. This vulnerability is fixed in 2.6.5 and 2.5.21."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-79", "description": "CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2024-10-03T14:24:44.300Z"}}}, "cveMetadata": {"cveId": "CVE-2024-47617", "state": "PUBLISHED", "dateUpdated": "2024-10-08T13:33:43.219Z", "dateReserved": "2024-09-27T20:37:22.121Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2024-10-03T14:24:44.300Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.1"}

{"affected": [{"affectedData": [{"product": "sulu", "vendor": "sulu", "versions": [{"status": "affected", "version": ">= 2.6.4, < 2.6.5"}, {"status": "affected", "version": ">= 2.5.20, < 2.5.21"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:sulu:sulu:2.5.20:*:*:*:*:*:*:*", "matchCriteriaId": "E7EFCD27-01AC-4C20-9F92-E1F1F0D9DFE4", "vulnerable": true}, {"criteria": "cpe:2.3:a:sulu:sulu:2.6.4:*:*:*:*:*:*:*", "matchCriteriaId": "C2DEEB21-3616-43D0-935D-95FDCFC361F7", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Sulu is a PHP content management system. This vulnerability allows an attacker to inject arbitrary HTML/JavaScript code through the media download URL in Sulu CMS. It affects the SuluMediaBundle component. The vulnerability is a Reflected Cross-Site Scripting (XSS) issue, which could potentially allow attackers to steal sensitive information, manipulate the website's content, or perform actions on behalf of the victim. This vulnerability is fixed in 2.6.5 and 2.5.21."}, {"lang": "es", "value": "Sulu es un sistema de gesti\u00f3n de contenido PHP. Esta vulnerabilidad permite a un atacante inyectar c\u00f3digo HTML/JavaScript arbitrario a trav\u00e9s de la URL de descarga de medios en Sulu CMS. Afecta al componente SuluMediaBundle. La vulnerabilidad es un problema de Cross-Site Scripting (XSS) Reflejado, que podr\u00eda permitir a los atacantes robar informaci\u00f3n confidencial, manipular el contenido del sitio web o realizar acciones en nombre de la v\u00edctima. Esta vulnerabilidad se ha corregido en las versiones 2.6.5 y 2.5.21."}], "id": "CVE-2024-47617", "lastModified": "2026-06-17T07:57:24.597", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.1, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 2.7, "source": "security-advisories@github.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.1, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 2.7, "source": "nvd@nist.gov", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2024-47617", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2024-10-03T14:38:49.459437Z", "version": "2.0.3"}}]}, "published": "2024-10-03T15:15:14.937", "references": [{"source": "security-advisories@github.com", "tags": ["Product"], "url": "https://github.com/sulu/sulu/commit/a5a5ae555d282e88ff8559d38cfb46dea7939bda"}, {"source": "security-advisories@github.com", "tags": ["Patch"], "url": "https://github.com/sulu/sulu/commit/eeacd14b6cf55f710084788140d40ebb00314b29"}, {"source": "security-advisories@github.com", "tags": ["Vendor Advisory"], "url": "https://github.com/sulu/sulu/security/advisories/GHSA-6784-9c82-vr85"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{}