CVE-2024-27087

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2024-27087
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-27087.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2024-27087
Aliases
Published
2024-02-26T16:44:31.105Z
Modified
2026-07-15T01:48:57.528272018Z
Severity
  • 4.6 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N CVSS Calculator
Summary
Kirby cross-site scripting (XSS) in the link field "Custom" type
Details

Kirby is a content management system. The new link field introduced in Kirby 4 allows several different link types that each validate the entered link to the relevant URL format. It also includes a "Custom" link type for advanced use cases that don't fit any of the pre-defined link formats. As the "Custom" link type is meant to be flexible, it also allows the javascript: URL scheme. In some use cases this can be intended, but it can also be misused by attackers to execute arbitrary JavaScript code when a user or visitor clicks on a link that is generated from the contents of the link field. This vulnerability is patched in 4.1.1.

Database specific 
{
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-79"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/27xxx/CVE-2024-27087.json"
}
References

Affected packages

Git / github.com/getkirby/kirby

Affected ranges

Type
GIT
Repo
https://github.com/getkirby/kirby
Events
Introduced
40eae8e8a4e1705412c64de63984376eeaa8b259
Fixed
1353c9fbe3ede6bee946f527d146841719eef7d5
Fixed
cda3dd9a15228d35e62ff86cfa87a67e7c687437
Database specific 
{
    "source": [
        "CPE_RANGE",
        "REFERENCES"
    ],
    "extracted_events": [
        {
            "introduced": "4.0.0"
        },
        {
            "fixed": "4.1.1"
        }
    ],
    "cpe": "cpe:2.3:a:getkirby:kirby:*:*:*:*:*:*:*:*"
}

Affected versions

4.*
4.0.0
4.0.1
4.0.2
4.0.3
4.1.0
4.1.0-rc.1
4.1.0-rc.2
4.1.0-rc.3

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-27087.json"