Stored XSS Vulnerability in django CMS Attributes Fields
CVE-2024-11406

6.9MEDIUM

Key Information:

Vendor

Django Cms Association

Status
Django Cms Attributes Fields
Vendor
CVE Published:
20 November 2024

What is CVE-2024-11406?

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in django CMS Association django CMS Attributes Fields allows Stored XSS.

This issue affects django CMS Attributes Fields: before 4.0.

Affected Version(s)

django CMS Attributes Fields 0 < 4.0

References

https://www.usom.gov.tr/bildirim/tr-24-1864
government-resourcebroken-link
https://www.django-cms.org/en/blog/2024/11/19/security-up...
https://iltosec.com/blog/post/djangocms-attributes-field-...

CVSS V3.1

Score:
6.9
Severity:
MEDIUM
Confidentiality:
High
Integrity:
Low
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
High
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

Credit

Ali ILTIZAR
.