CVE-2024-39318

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2024-39318
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-39318.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2024-39318
Aliases
Related
Published
2024-07-31T15:38:48.237Z
Modified
2026-02-04T02:39:32.852129Z
Severity
  • 5.4 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N CVSS Calculator
Summary
Ibexa Admin UI vulnerable to DOM-based Cross-site Scripting in file upload widget
Details

The Ibexa Admin UI Bundle contains all the necessary parts to run the Ibexa DXP Back Office interface. The file upload widget is vulnerable to XSS payloads in filenames. Access permission to upload files is required. As such, in most cases only authenticated editors and administrators will have the required permission. It is not persistent, i.e. the payload is only executed during the upload. In effect, an attacker will have to trick an editor/administrator into uploading a strangely named file.

Database specific 
{
    "cwe_ids": [
        "CWE-79"
    ],
    "cna_assigner": "GitHub_M",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/39xxx/CVE-2024-39318.json"
}
References

Affected packages

Git / github.com/ezsystems/ezplatform-admin-ui

Affected ranges

Type
GIT
Repo
https://github.com/ezsystems/ezplatform-admin-ui
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
7a9f991b200fa5a03d49cd07f50577c8bc90a30b

Affected versions

v1.*
v1.0.0
v1.0.0-beta1
v1.0.0-beta2
v1.0.0-beta3
v1.0.0-beta4
v1.0.0-beta5
v1.0.0-rc1
v1.0.0.1
v1.0.0.2
v1.0.1
v1.0.2
v1.0.2-rc1
v1.0.2.1
v1.0.2.2
v1.1.0
v1.1.0-beta1
v1.2.0-beta1
v1.2.0-rc1

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-39318.json"

Git / github.com/ibexa/admin-ui

Affected ranges

Type
GIT
Repo
https://github.com/ibexa/admin-ui
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
8dc413fad1045fcfbe65dbcb0bea8516accc4c3e

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-39318.json"