CVE-2024-50348

InstantCMS is a free and open source content management system. In photo upload function in the photo album page there is no input validation taking place. Due to this attackers are able to inject the XSS (Cross Site Scripting) payload and execute. This vulnerability is fixed in 2.16.3.

CVSS v3 5.4 MEDIUM

5.4^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.3 / Impact : 2.7

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction REQUIRED

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact NONE

Scope CHANGED

References

Link	Resource
https://github.com/instantsoft/icms2/commit/e02de2fa1850bb40c9b2050b9256c838a0ea7aa3	Patch
https://github.com/instantsoft/icms2/security/advisories/GHSA-f6cf-jg84-fw29	Exploit Patch Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:instantcms:instantcms:*:*:*:*:*:*:*:*

History

No history.

Information

Published : 2024-10-29 23:15

Updated : 2024-11-06 14:49

NVD link : CVE-2024-50348

Mitre link : CVE-2024-50348

CVE.ORG link : CVE-2024-50348

JSON object : View

Products Affected

instantcms

instantcms

CWE

CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

{"id": "CVE-2024-50348", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 5.4, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}, "impactScore": 2.7, "exploitabilityScore": 2.3}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 5.4, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}, "impactScore": 2.7, "exploitabilityScore": 2.3}]}, "published": "2024-10-29T23:15:03.863", "references": [{"url": "https://github.com/instantsoft/icms2/commit/e02de2fa1850bb40c9b2050b9256c838a0ea7aa3", "tags": ["Patch"], "source": "security-advisories@github.com"}, {"url": "https://github.com/instantsoft/icms2/security/advisories/GHSA-f6cf-jg84-fw29", "tags": ["Exploit", "Patch", "Vendor Advisory"], "source": "security-advisories@github.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-79"}]}], "descriptions": [{"lang": "en", "value": "InstantCMS is a free and open source content management system. In photo upload function in the photo album page there is no input validation taking place. Due to this attackers are able to inject the XSS (Cross Site Scripting) payload and execute. This vulnerability is fixed in 2.16.3."}, {"lang": "es", "value": "InstantCMS es un sistema de gesti\u00f3n de contenido gratuito y de c\u00f3digo abierto. En la funci\u00f3n de carga de fotos de la p\u00e1gina del \u00e1lbum de fotos no se realiza ninguna validaci\u00f3n de entrada. Debido a esto, los atacantes pueden inyectar el payload XSS (Cross Site Scripting) y ejecutarlo. Esta vulnerabilidad se corrigi\u00f3 en la versi\u00f3n 2.16.3."}], "lastModified": "2024-11-06T14:49:46.073", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:instantcms:instantcms:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "D502D2E1-810F-4B47-97EA-779586CB2B78", "versionEndExcluding": "2.16.3"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}