CVE-2024-21622
This is a potential moderate impact, low complexity privilege escalation vulnerability in Craft starting in 3.x prior to 3.9.6 and 4.x prior to 4.4.16 with certain user permissions setups.
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (0.59%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
Craft is a content management system. This is a potential moderate impact, low complexity privilege escalation vulnerability in Craft starting in 3.x prior to 3.9.6 and 4.x prior to 4.4.16 with certain user permissions setups. This has been fixed in Craft 4.4.16 and Craft 3.9.6. Users should ensure they are running at least those versions.
- CVSS 3.1
- 8.8 HIGHCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- EPSS
- 0.59% probability · 46th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-269
- Affected
- craftcms/craft cms
- Source
- security-advisories@github.com
References
- https://github.com/craftcms/cms/blob/develop/CHANGELOG.md#4511---2023-11-16Release Notes
- https://github.com/craftcms/cms/blob/v3/CHANGELOG.md#396---2023-11-16Release Notes
- https://github.com/craftcms/cms/commit/76caf9af07d9964be0fd362772223be6a5f5b6aaPatch
- https://github.com/craftcms/cms/commit/be81eb653d633833f2ab22510794abb6bb9c0843Patch
- https://github.com/craftcms/cms/pull/13931Issue Tracking, Patch
- https://github.com/craftcms/cms/pull/13932Issue Tracking, Patch
- https://github.com/craftcms/cms/security/advisories/GHSA-j5g9-j7r4-6qvxVendor Advisory
- https://github.com/craftcms/cms/blob/develop/CHANGELOG.md#4511---2023-11-16Release Notes
- https://github.com/craftcms/cms/blob/v3/CHANGELOG.md#396---2023-11-16Release Notes
- https://github.com/craftcms/cms/commit/76caf9af07d9964be0fd362772223be6a5f5b6aaPatch
- https://github.com/craftcms/cms/commit/be81eb653d633833f2ab22510794abb6bb9c0843Patch
- https://github.com/craftcms/cms/pull/13931Issue Tracking, Patch
- https://github.com/craftcms/cms/pull/13932Issue Tracking, Patch
- https://github.com/craftcms/cms/security/advisories/GHSA-j5g9-j7r4-6qvxVendor Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.