CVE-2024-21622: Craft CMS Privilege Escalation
Summary
CVE-2024-21622: Craft CMS Privilege Escalation. Affects craftcms/cms across 2 version ranges.
>= 3.0.0, < 3.9.6
>= 4.0.0-RC1, < 4.5.11
Fixed in 3.9.6 or 4.5.11, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Craft CMS is an open-source content management system that allows users to create and manage websites. It provides a flexible and customizable platform for developers and content creators. Craft CMS is vulnerable to a privilege escalation issue that can potentially allow unauthorized users to gain elevated privileges within the system.
Vulnerability Detail
The privilege escalation vulnerability in Craft CMS affects certain user permission setups. It has a moderate impact and low complexity. An attacker with limited privileges can exploit this vulnerability to escalate their privileges and gain unauthorized access to sensitive information or perform malicious actions within the system.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 3.0.0, < 3.9.63.9.6composer require craftcms/cms:3.9.6 -
>= 4.0.0-RC1, < 4.5.114.5.11composer require craftcms/cms:4.5.11
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Conclusion
Craft CMS is vulnerable to a privilege escalation issue that can potentially allow unauthorized users to gain elevated privileges within the system. Users should ensure they are running at least Craft CMS version 4.4.16 or Craft CMS version 3.9.6 to address this vulnerability. For further support on vulnerability remediation, contact DevNack.com.
See every vulnerability recorded for craftcms/cms →
FAQ
Craft CMS is an open-source content management system that allows users to create and manage websites. It provides a flexible and customizable platform for developers and content creators.
A privilege escalation vulnerability is a security flaw that allows an attacker to gain elevated privileges within a system. In the case of Craft CMS, this vulnerability can allow unauthorized users to escalate their privileges and gain access to sensitive information or perform malicious actions.
This vulnerability has a moderate impact, as it can potentially allow unauthorized users to gain elevated privileges within the Craft CMS system. This can lead to unauthorized access to sensitive information or the ability to perform malicious actions.
To fix this vulnerability, users should ensure that they are running at least Craft CMS version 4.4.16 or Craft CMS version 3.9.6. These versions include the necessary patches to address the privilege escalation issue. Users can update their Craft CMS installation by following the official upgrade instructions provided by the Craft CMS team.
No specific workaround has been mentioned for this vulnerability. It is recommended to update to the patched versions of Craft CMS to mitigate the risk.
References
Related vulnerabilities
Recent vulnerabilities recorded for craftcms/cms.
