CVE-2024-21622

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2024-21622
Craft is a content management system. This is a potential moderate impact, low complexity privilege escalation vulnerability in Craft starting in 3.x prior to 3.9.6 and 4.x prior to 4.4.16 with certain user permissions setups. This has been fixed in Craft 4.4.16 and Craft 3.9.6. Users should ensure they are running at least those versions.

5.4 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 2.3 / Impact : 2.7

Attack Vector ADJACENT_NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact LOW

Availability Impact LOW

Scope CHANGED

References
Link Resource
https://github.com/craftcms/cms/blob/develop/CHANGELOG.md#4511---2023-11-16 Release Notes
https://github.com/craftcms/cms/blob/v3/CHANGELOG.md#396---2023-11-16 Release Notes
https://github.com/craftcms/cms/commit/76caf9af07d9964be0fd362772223be6a5f5b6aa Patch
https://github.com/craftcms/cms/commit/be81eb653d633833f2ab22510794abb6bb9c0843 Patch
https://github.com/craftcms/cms/pull/13931 Issue Tracking Patch
https://github.com/craftcms/cms/pull/13932 Issue Tracking Patch
https://github.com/craftcms/cms/security/advisories/GHSA-j5g9-j7r4-6qvx Vendor Advisory
https://github.com/craftcms/cms/blob/develop/CHANGELOG.md#4511---2023-11-16 Release Notes
https://github.com/craftcms/cms/blob/v3/CHANGELOG.md#396---2023-11-16 Release Notes
https://github.com/craftcms/cms/commit/76caf9af07d9964be0fd362772223be6a5f5b6aa Patch
https://github.com/craftcms/cms/commit/be81eb653d633833f2ab22510794abb6bb9c0843 Patch
https://github.com/craftcms/cms/pull/13931 Issue Tracking Patch
https://github.com/craftcms/cms/pull/13932 Issue Tracking Patch
https://github.com/craftcms/cms/security/advisories/GHSA-j5g9-j7r4-6qvx Vendor Advisory
Configurations

Configuration 1 (hide)

OR cpe:2.3:a:craftcms:craft_cms:*:*:*:*:*:*:*:*
cpe:2.3:a:craftcms:craft_cms:*:*:*:*:*:*:*:*
History

21 Nov 2024, 08:54

Type Values Removed Values Added
CVSS v2 : unknown
v3 : 8.8 		v2 : unknown
v3 : 5.4
References () https://github.com/craftcms/cms/blob/develop/CHANGELOG.md#4511---2023-11-16 - Release Notes () https://github.com/craftcms/cms/blob/develop/CHANGELOG.md#4511---2023-11-16 - Release Notes
References () https://github.com/craftcms/cms/blob/v3/CHANGELOG.md#396---2023-11-16 - Release Notes () https://github.com/craftcms/cms/blob/v3/CHANGELOG.md#396---2023-11-16 - Release Notes
References () https://github.com/craftcms/cms/commit/76caf9af07d9964be0fd362772223be6a5f5b6aa - Patch () https://github.com/craftcms/cms/commit/76caf9af07d9964be0fd362772223be6a5f5b6aa - Patch
References () https://github.com/craftcms/cms/commit/be81eb653d633833f2ab22510794abb6bb9c0843 - Patch () https://github.com/craftcms/cms/commit/be81eb653d633833f2ab22510794abb6bb9c0843 - Patch
References () https://github.com/craftcms/cms/pull/13931 - Issue Tracking, Patch () https://github.com/craftcms/cms/pull/13931 - Issue Tracking, Patch
References () https://github.com/craftcms/cms/pull/13932 - Issue Tracking, Patch () https://github.com/craftcms/cms/pull/13932 - Issue Tracking, Patch
References () https://github.com/craftcms/cms/security/advisories/GHSA-j5g9-j7r4-6qvx - Vendor Advisory () https://github.com/craftcms/cms/security/advisories/GHSA-j5g9-j7r4-6qvx - Vendor Advisory

10 Jan 2024, 18:34

Type Values Removed Values Added
First Time Craftcms
Craftcms craft Cms
CPE cpe:2.3:a:craftcms:craft_cms:*:*:*:*:*:*:*:*
CWE NVD-CWE-noinfo
References () https://github.com/craftcms/cms/blob/develop/CHANGELOG.md#4511---2023-11-16 - () https://github.com/craftcms/cms/blob/develop/CHANGELOG.md#4511---2023-11-16 - Release Notes
References () https://github.com/craftcms/cms/blob/v3/CHANGELOG.md#396---2023-11-16 - () https://github.com/craftcms/cms/blob/v3/CHANGELOG.md#396---2023-11-16 - Release Notes
References () https://github.com/craftcms/cms/commit/76caf9af07d9964be0fd362772223be6a5f5b6aa - () https://github.com/craftcms/cms/commit/76caf9af07d9964be0fd362772223be6a5f5b6aa - Patch
References () https://github.com/craftcms/cms/commit/be81eb653d633833f2ab22510794abb6bb9c0843 - () https://github.com/craftcms/cms/commit/be81eb653d633833f2ab22510794abb6bb9c0843 - Patch
References () https://github.com/craftcms/cms/pull/13931 - () https://github.com/craftcms/cms/pull/13931 - Issue Tracking, Patch
References () https://github.com/craftcms/cms/pull/13932 - () https://github.com/craftcms/cms/pull/13932 - Issue Tracking, Patch
References () https://github.com/craftcms/cms/security/advisories/GHSA-j5g9-j7r4-6qvx - () https://github.com/craftcms/cms/security/advisories/GHSA-j5g9-j7r4-6qvx - Vendor Advisory
Summary
  • (es) Craft es un sistema de gestión de contenidos. Esta es una posible vulnerabilidad de escalada de privilegios de baja complejidad y impacto moderado en Craft a partir de 3.x anterior a 3.9.6 y 4.x anterior a 4.4.16 con ciertas configuraciones de permisos de usuario. Esto se ha solucionado en Craft 4.4.16 y Craft 3.9.6. Los usuarios deben asegurarse de estar ejecutando al menos esas versiones.
CVSS v2 : unknown
v3 : 5.4 		v2 : unknown
v3 : 8.8

03 Jan 2024, 17:26

Type Values Removed Values Added
New CVE
Information

Published : 2024-01-03 17:15

Updated : 2024-11-21 08:54

NVD link : CVE-2024-21622

Mitre link : CVE-2024-21622

CVE.ORG link : CVE-2024-21622

JSON object : View

Products Affected

craftcms

  • craft_cms
CWE
CWE-269

Improper Privilege Management

NVD-CWE-noinfo