Sulu vulnerable to XSS via uploaded SVG
CVE-2024-47618

5.4MEDIUM

Key Information:

Vendor

Sulu

Status
Sulu
Vendor
CVE Published:
3 October 2024

What is CVE-2024-47618?

Sulu is a PHP content management system. Sulu is vulnerable against XSS whereas a low privileged user with access to the “Media” section can upload an SVG file with a malicious payload. Once uploaded and accessed, the malicious javascript will be executed on the victims’ (other users including admins) browsers. This issue is fixed in 2.6.5.

Affected Version(s)

sulu >= 2.0.0-RC1, < 2.6.5

References

https://github.com/sulu/sulu/security/advisories/GHSA-255...
x_refsource_CONFIRM
https://github.com/sulu/sulu/commit/ca72f75eebe41ea772662...
x_refsource_MISC

CVSS V3.1

Score:
5.4
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

.