CVE-2024-21622

Katalog CVE

CVSS 8.8 · High EPSS 0,59%

Kerentanan Improper Privilege Management pada craftcms craft cms. Skor CVSS 3.1 8.8 (High) menurut NVD.

Deskripsi (NVD)

Craft is a content management system. This is a potential moderate impact, low complexity privilege escalation vulnerability in Craft starting in 3.x prior to 3.9.6 and 4.x prior to 4.4.16 with certain user permissions setups. This has been fixed in Craft 4.4.16 and Craft 3.9.6. Users should ensure they are running at least those versions.

Rincian

Terbit di NVD

3 Januari 2024

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

8.8 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-269: Improper Privilege Management

EPSS (30 hari)

0,59% peluang dieksploitasi; lebih tinggi dari 46,6% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/craftcms/cms/security/advisories/GHSA-j5g9-j7r4-6qvx advisory vendor
• https://github.com/craftcms/cms/commit/76caf9af07d9964be0fd362772223be6a5f5b6aa patch
• https://github.com/craftcms/cms/commit/be81eb653d633833f2ab22510794abb6bb9c0843 patch
• https://github.com/craftcms/cms/pull/13931 issue tracking · patch
• https://github.com/craftcms/cms/pull/13932 issue tracking · patch
• https://github.com/craftcms/cms/blob/develop/CHANGELOG.md#4511---2023-11-16 release notes
• https://github.com/craftcms/cms/blob/v3/CHANGELOG.md#396---2023-11-16 release notes