CVE-2024-47617CWE-79

Reflected XSS Vulnerability in Sulu Media Bundle

Medium · published October 3, 2024

CVSS v3.1
6.1
EPSS
0%
Percentile
32.4
In the wild
Unconfirmed
What it is

Sulu is a PHP content management system. This vulnerability allows an attacker to inject arbitrary HTML/JavaScript code through the media download URL in Sulu CMS. It affects the SuluMediaBundle component. The vulnerability is a Reflected Cross-Site Scripting (XSS) issue, which could potentially allow attackers to steal sensitive information, manipulate the website's content, or perform actions on behalf of the victim. This vulnerability is fixed in 2.6.5 and 2.5.21.

The record
Technical detail
CVSS v3.1
6.1 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00394 · 32.4th percentile
Weakness
CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Published
2024-10-03T14:24Z
EPSS history
Timeline
  • 03 OCT 14:24Z
    Reflected XSS Vulnerability in Sulu Media Bundle
    cvelistv5