VulnerabilityModified
CVE-2024-24807
The HTML is executed when the tag name is listed in the auto complete form.
MEDIUM 4.8EPSS 0.52%
Does this matter?
Lower severity and a low EPSS score (0.52%). Track it; it rarely justifies an emergency change on its own.
Description
Sulu is a highly extensible open-source PHP content management system based on the Symfony framework. There is an issue when inputting HTML into the Tag name. The HTML is executed when the tag name is listed in the auto complete form. Only admin users can create tags so they are the only ones affected. The problem is patched with version(s) 2.4.16 and 2.5.12.
- CVSS 3.1
- 4.8 MEDIUMCVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
- EPSS
- 0.52% probability · 43th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-80, CWE-79
- Affected
- sulu/sulu
- Source
- security-advisories@github.com
References
- https://github.com/sulu/sulu/releases/tag/2.4.16Release Notes
- https://github.com/sulu/sulu/releases/tag/2.5.12Release Notes
- https://github.com/sulu/sulu/security/advisories/GHSA-gfrh-gwqc-63cvVendor Advisory
- https://github.com/sulu/sulu/releases/tag/2.4.16Release Notes
- https://github.com/sulu/sulu/releases/tag/2.5.12Release Notes
- https://github.com/sulu/sulu/security/advisories/GHSA-gfrh-gwqc-63cvVendor Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.