CVE-2024-12503

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2024-12503
A vulnerability classified as problematic was found in ClassCMS 4.8. Affected by this vulnerability is an unknown functionality of the file /index.php/admin of the component Model Management Page. The manipulation of the argument URL leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.

2.4 /10

CVSS v3 : LOW

V3 Legend

Vector :

Exploitability : 0.9 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required HIGH

User Interaction REQUIRED

Confidentiality Impact NONE

Integrity Impact LOW

Availability Impact NONE

Scope UNCHANGED

3.3 /10

CVSS v2.0 : LOW

V2 Legend

Vector : AV:N/AC:L/Au:M/C:N/I:P/A:N

Exploitability : 6.4 / Impact : 2.9

Access Vector NETWORK

Access Complexity LOW

Authentication MULTIPLE

Confidentiality Impact NONE

Integrity Impact PARTIAL

Availability Impact NONE

References
Link Resource
https://github.com/Jack-Black-13/blob/blob/main/classCMS_v4.8_model_xss.md Exploit Third Party Advisory
https://vuldb.com/?ctiid.287875 Permissions Required VDB Entry
https://vuldb.com/?id.287875 Permissions Required VDB Entry
https://vuldb.com/?submit.461085 Third Party Advisory VDB Entry
Configurations

Configuration 1 (hide)

cpe:2.3:a:classcms:classcms:4.8:*:*:*:*:*:*:*
History

13 Dec 2024, 17:13

Type Values Removed Values Added
CPE cpe:2.3:a:classcms:classcms:4.8:*:*:*:*:*:*:*
First Time Classcms classcms
Classcms
References () https://github.com/Jack-Black-13/blob/blob/main/classCMS_v4.8_model_xss.md - () https://github.com/Jack-Black-13/blob/blob/main/classCMS_v4.8_model_xss.md - Exploit, Third Party Advisory
References () https://vuldb.com/?ctiid.287875 - () https://vuldb.com/?ctiid.287875 - Permissions Required, VDB Entry
References () https://vuldb.com/?id.287875 - () https://vuldb.com/?id.287875 - Permissions Required, VDB Entry
References () https://vuldb.com/?submit.461085 - () https://vuldb.com/?submit.461085 - Third Party Advisory, VDB Entry
Summary
  • (es) En ClassCMS 4.8 se ha detectado una vulnerabilidad clasificada como problemática. Esta vulnerabilidad afecta a una funcionalidad desconocida del archivo /index.php/admin del componente Model Management Page. La manipulación de la URL del argumento provoca ataques de Cross-Site Scripting. El ataque se puede ejecutar de forma remota. El exploit se ha hecho público y puede utilizarse.

12 Dec 2024, 02:15

Type Values Removed Values Added
New CVE
Information

Published : 2024-12-12 02:15

Updated : 2024-12-13 17:13

NVD link : CVE-2024-12503

Mitre link : CVE-2024-12503

CVE.ORG link : CVE-2024-12503

JSON object : View

Products Affected

classcms

  • classcms
CWE
CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CWE-94

Improper Control of Generation of Code ('Code Injection')