CVE-2024-21622
Vulnerability from cvelistv5
Published
2024-01-03 16:51
Modified
2024-08-01 22:27
Summary
Craft is a content management system. This is a potential moderate impact, low complexity privilege escalation vulnerability in Craft starting in 3.x prior to 3.9.6 and 4.x prior to 4.4.16 with certain user permissions setups. This has been fixed in Craft 4.4.16 and Craft 3.9.6. Users should ensure they are running at least those versions.
References
security-advisories@github.comhttps://github.com/craftcms/cms/blob/develop/CHANGELOG.md#4511---2023-11-16Release Notes
security-advisories@github.comhttps://github.com/craftcms/cms/blob/v3/CHANGELOG.md#396---2023-11-16Release Notes
security-advisories@github.comhttps://github.com/craftcms/cms/commit/76caf9af07d9964be0fd362772223be6a5f5b6aaPatch
security-advisories@github.comhttps://github.com/craftcms/cms/commit/be81eb653d633833f2ab22510794abb6bb9c0843Patch
security-advisories@github.comhttps://github.com/craftcms/cms/pull/13931Issue Tracking, Patch
security-advisories@github.comhttps://github.com/craftcms/cms/pull/13932Issue Tracking, Patch
security-advisories@github.comhttps://github.com/craftcms/cms/security/advisories/GHSA-j5g9-j7r4-6qvxVendor Advisory
af854a3a-2127-422b-91ae-364da2661108https://github.com/craftcms/cms/blob/develop/CHANGELOG.md#4511---2023-11-16Release Notes
af854a3a-2127-422b-91ae-364da2661108https://github.com/craftcms/cms/blob/v3/CHANGELOG.md#396---2023-11-16Release Notes
af854a3a-2127-422b-91ae-364da2661108https://github.com/craftcms/cms/commit/76caf9af07d9964be0fd362772223be6a5f5b6aaPatch
af854a3a-2127-422b-91ae-364da2661108https://github.com/craftcms/cms/commit/be81eb653d633833f2ab22510794abb6bb9c0843Patch
af854a3a-2127-422b-91ae-364da2661108https://github.com/craftcms/cms/pull/13931Issue Tracking, Patch
af854a3a-2127-422b-91ae-364da2661108https://github.com/craftcms/cms/pull/13932Issue Tracking, Patch
af854a3a-2127-422b-91ae-364da2661108https://github.com/craftcms/cms/security/advisories/GHSA-j5g9-j7r4-6qvxVendor Advisory
Impacted products
Vendor Product Version
Show details on NVD website


{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-01T22:27:35.206Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "https://github.com/craftcms/cms/security/advisories/GHSA-j5g9-j7r4-6qvx",
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://github.com/craftcms/cms/security/advisories/GHSA-j5g9-j7r4-6qvx"
          },
          {
            "name": "https://github.com/craftcms/cms/pull/13931",
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/craftcms/cms/pull/13931"
          },
          {
            "name": "https://github.com/craftcms/cms/pull/13932",
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/craftcms/cms/pull/13932"
          },
          {
            "name": "https://github.com/craftcms/cms/commit/76caf9af07d9964be0fd362772223be6a5f5b6aa",
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/craftcms/cms/commit/76caf9af07d9964be0fd362772223be6a5f5b6aa"
          },
          {
            "name": "https://github.com/craftcms/cms/commit/be81eb653d633833f2ab22510794abb6bb9c0843",
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/craftcms/cms/commit/be81eb653d633833f2ab22510794abb6bb9c0843"
          },
          {
            "name": "https://github.com/craftcms/cms/blob/develop/CHANGELOG.md#4511---2023-11-16",
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/craftcms/cms/blob/develop/CHANGELOG.md#4511---2023-11-16"
          },
          {
            "name": "https://github.com/craftcms/cms/blob/v3/CHANGELOG.md#396---2023-11-16",
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/craftcms/cms/blob/v3/CHANGELOG.md#396---2023-11-16"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "cms",
          "vendor": "craftcms",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 4.0.0-RC1, \u003c 4.5.11"
            },
            {
              "status": "affected",
              "version": "\u003e= 3.0.0, \u003c 3.9.6"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Craft is a content management system. This is a potential moderate impact, low complexity privilege escalation vulnerability in Craft starting in 3.x prior to 3.9.6 and 4.x prior to 4.4.16 with certain user permissions setups. This has been fixed in Craft 4.4.16 and Craft 3.9.6. Users should ensure they are running at least those versions."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "ADJACENT_NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 5.4,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "LOW",
            "privilegesRequired": "LOW",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:L",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-269",
              "description": "CWE-269: Improper Privilege Management",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-01-03T16:51:25.704Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/craftcms/cms/security/advisories/GHSA-j5g9-j7r4-6qvx",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/craftcms/cms/security/advisories/GHSA-j5g9-j7r4-6qvx"
        },
        {
          "name": "https://github.com/craftcms/cms/pull/13931",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/craftcms/cms/pull/13931"
        },
        {
          "name": "https://github.com/craftcms/cms/pull/13932",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/craftcms/cms/pull/13932"
        },
        {
          "name": "https://github.com/craftcms/cms/commit/76caf9af07d9964be0fd362772223be6a5f5b6aa",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/craftcms/cms/commit/76caf9af07d9964be0fd362772223be6a5f5b6aa"
        },
        {
          "name": "https://github.com/craftcms/cms/commit/be81eb653d633833f2ab22510794abb6bb9c0843",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/craftcms/cms/commit/be81eb653d633833f2ab22510794abb6bb9c0843"
        },
        {
          "name": "https://github.com/craftcms/cms/blob/develop/CHANGELOG.md#4511---2023-11-16",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/craftcms/cms/blob/develop/CHANGELOG.md#4511---2023-11-16"
        },
        {
          "name": "https://github.com/craftcms/cms/blob/v3/CHANGELOG.md#396---2023-11-16",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/craftcms/cms/blob/v3/CHANGELOG.md#396---2023-11-16"
        }
      ],
      "source": {
        "advisory": "GHSA-j5g9-j7r4-6qvx",
        "discovery": "UNKNOWN"
      },
      "title": "Craft CMS Privilege Escalation"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2024-21622",
    "datePublished": "2024-01-03T16:51:25.704Z",
    "dateReserved": "2023-12-29T03:00:44.953Z",
    "dateUpdated": "2024-08-01T22:27:35.206Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "meta": {
    "nvd": "{\"cve\":{\"id\":\"CVE-2024-21622\",\"sourceIdentifier\":\"security-advisories@github.com\",\"published\":\"2024-01-03T17:15:12.330\",\"lastModified\":\"2024-11-21T08:54:44.617\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"Craft is a content management system. This is a potential moderate impact, low complexity privilege escalation vulnerability in Craft starting in 3.x prior to 3.9.6 and 4.x prior to 4.4.16 with certain user permissions setups. This has been fixed in Craft 4.4.16 and Craft 3.9.6. Users should ensure they are running at least those versions.\"},{\"lang\":\"es\",\"value\":\"Craft es un sistema de gesti\u00f3n de contenidos. Esta es una posible vulnerabilidad de escalada de privilegios de baja complejidad y impacto moderado en Craft a partir de 3.x anterior a 3.9.6 y 4.x anterior a 4.4.16 con ciertas configuraciones de permisos de usuario. Esto se ha solucionado en Craft 4.4.16 y Craft 3.9.6. Los usuarios deben asegurarse de estar ejecutando al menos esas versiones.\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:L\",\"baseScore\":5.4,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"ADJACENT_NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"CHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"LOW\",\"availabilityImpact\":\"LOW\"},\"exploitabilityScore\":2.3,\"impactScore\":2.7},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":8.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":2.8,\"impactScore\":5.9}]},\"weaknesses\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-269\"}]},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"NVD-CWE-noinfo\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:craftcms:craft_cms:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"3.0.0\",\"versionEndExcluding\":\"3.9.6\",\"matchCriteriaId\":\"36AC4498-6DDF-4F74-BD12-86BF5479F10A\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:craftcms:craft_cms:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"4.0.0\",\"versionEndIncluding\":\"4.5.15\",\"matchCriteriaId\":\"9B004CCA-A979-42AD-ADD4-1BEFDB964C78\"}]}]}],\"references\":[{\"url\":\"https://github.com/craftcms/cms/blob/develop/CHANGELOG.md#4511---2023-11-16\",\"source\":\"security-advisories@github.com\",\"tags\":[\"Release Notes\"]},{\"url\":\"https://github.com/craftcms/cms/blob/v3/CHANGELOG.md#396---2023-11-16\",\"source\":\"security-advisories@github.com\",\"tags\":[\"Release Notes\"]},{\"url\":\"https://github.com/craftcms/cms/commit/76caf9af07d9964be0fd362772223be6a5f5b6aa\",\"source\":\"security-advisories@github.com\",\"tags\":[\"Patch\"]},{\"url\":\"https://github.com/craftcms/cms/commit/be81eb653d633833f2ab22510794abb6bb9c0843\",\"source\":\"security-advisories@github.com\",\"tags\":[\"Patch\"]},{\"url\":\"https://github.com/craftcms/cms/pull/13931\",\"source\":\"security-advisories@github.com\",\"tags\":[\"Issue Tracking\",\"Patch\"]},{\"url\":\"https://github.com/craftcms/cms/pull/13932\",\"source\":\"security-advisories@github.com\",\"tags\":[\"Issue Tracking\",\"Patch\"]},{\"url\":\"https://github.com/craftcms/cms/security/advisories/GHSA-j5g9-j7r4-6qvx\",\"source\":\"security-advisories@github.com\",\"tags\":[\"Vendor Advisory\"]},{\"url\":\"https://github.com/craftcms/cms/blob/develop/CHANGELOG.md#4511---2023-11-16\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Release Notes\"]},{\"url\":\"https://github.com/craftcms/cms/blob/v3/CHANGELOG.md#396---2023-11-16\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Release Notes\"]},{\"url\":\"https://github.com/craftcms/cms/commit/76caf9af07d9964be0fd362772223be6a5f5b6aa\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://github.com/craftcms/cms/commit/be81eb653d633833f2ab22510794abb6bb9c0843\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://github.com/craftcms/cms/pull/13931\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Issue Tracking\",\"Patch\"]},{\"url\":\"https://github.com/craftcms/cms/pull/13932\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Issue Tracking\",\"Patch\"]},{\"url\":\"https://github.com/craftcms/cms/security/advisories/GHSA-j5g9-j7r4-6qvx\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Vendor Advisory\"]}]}}"
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.


Loading…

Loading…

Loading…

Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.