CVE-2024-50803: Redaxo Core CMS Mediapool XSS Vulnerability
Summary
CVE-2024-50803: Redaxo Core CMS Cross Site Scripting (XSS). Affects redaxo/source versions < 5.18.0. Fixed in 5.18.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Redaxo is an open-source content management system (CMS) that allows users to create and manage websites with ease. It features a modular architecture, enabling developers to extend its functionality through add-ons. The mediapool feature allows users to manage media files, but it has been found to be vulnerable to Cross Site Scripting (XSS) attacks, which can lead to unauthorized actions being performed on behalf of users.
Vulnerability Detail
The vulnerability in Redaxo Core CMS version 5.17.1 arises from improper handling of user input in the mediapool feature. This flaw allows remote attackers to inject malicious scripts into web pages viewed by other users. If exploited, this could lead to session hijacking, data theft, or other malicious activities, as attackers can escalate their privileges and perform actions as legitimate users.
How To Fix
Minimum fixed version
5.18.0
This is the first release that contains the fix.
composer require redaxo/source:5.18.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can restrict access to the mediapool feature for untrusted users until the package is updated. This can be done by modifying user permissions in the Redaxo admin panel.
Conclusion
The Redaxo Core CMS has a critical XSS vulnerability in its mediapool feature, which can be exploited by remote attackers. It is crucial to update to version 5.18.0 or later to mitigate this risk. Additionally, consider using Vulert to monitor your application for vulnerabilities in real-time.
See every vulnerability recorded for redaxo/source →
FAQ
XSS is a security vulnerability that allows attackers to inject malicious scripts into web pages viewed by other users, potentially leading to unauthorized actions.
You can check if your application is affected by using Vulert, which monitors open-source vulnerabilities in real-time. Visit Vulert Scanner to test your application without any signup.
If left unaddressed, this vulnerability could allow attackers to hijack user sessions, steal sensitive information, or perform actions on behalf of users, compromising the integrity of your website.
Yes, you can restrict access to the mediapool feature for untrusted users as a temporary measure until the package is updated.
Detailed information can be found in the advisory published on GitHub and the National Vulnerability Database (NVD).
Related vulnerabilities
Recent vulnerabilities recorded for redaxo/source.
