CVE-2024-45406: Craft CMS vulnerable to stored XSS in breadcrumb list and title fields
Summary
CVE-2024-45406: Craft CMS vulnerable to stored XSS in breadcrumb list and title fields. Affects craftcms/cms versions >= 5.0.0, < 5.1.2. Fixed in 5.1.2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Craft CMS is an open-source content management system that allows users to create and manage websites. It provides a user-friendly interface for managing categories, entries, and user accounts. However, Craft CMS is vulnerable to stored cross-site scripting (XSS) attacks in the breadcrumb list and title fields. These fields do not properly sanitize user input, allowing malicious users to inject and execute arbitrary JavaScript code.
Vulnerability Detail
The vulnerability allows attackers to inject malicious code into the breadcrumb list and title fields, which are displayed in various pages of the CMS. This can lead to the execution of arbitrary JavaScript code in the context of the affected user's browser. The impact of this vulnerability is that malicious users can tamper with the control panel and potentially compromise the security and integrity of the CMS.
How To Fix
Minimum fixed version
5.1.2
This is the first release that contains the fix.
composer require craftcms/cms:5.1.2Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is recommended to apply the official patch provided by the Craft CMS development team.
Conclusion
Craft CMS is vulnerable to stored XSS attacks in the breadcrumb list and title fields. The impact of this vulnerability is that malicious users can tamper with the control panel and potentially compromise the security and integrity of the CMS. Users are advised to update their CMS installation to version 5.1.2 or later to mitigate the risk of XSS attacks.
See every vulnerability recorded for craftcms/cms →
FAQ
Craft CMS is an open-source content management system that allows users to create and manage websites.
Stored XSS is a type of cross-site scripting attack where the malicious code is permanently stored on the target server and executed when a user accesses the affected page.
The vulnerability allows malicious users to tamper with the control panel of Craft CMS, potentially compromising the security and integrity of the CMS.
To fix this vulnerability, update your Craft CMS installation to version 5.1.2 or later, which includes the necessary patch to prevent XSS attacks.
There is no known workaround for this vulnerability. It is recommended to apply the official patch provided by the Craft CMS development team.
References
Related vulnerabilities
Recent vulnerabilities recorded for craftcms/cms.
