Craft CMS Privilege Escalation

高 8.8CVE-2024-21622 · GHSA-j5g9-j7r4-6qvx · 03/01/2024 公開 · 17/06/2026 更新

要点

CVE-2024-21622 は craftcms/cms, craft cms (craftcms) に影響する深刻度「高」 (CVSS 8.8) の脆弱性です。
今後30日間に悪用される確率（EPSS）：0.59%（全脆弱性の 48.1% より高い）。
対処：3.9.6, 4.5.11 以降に更新してください。

パッケージ	影響を受けるバージョン	修正済みバージョン
craftcms/cms Packagist	`≥ 3.0.0, < 3.9.6≥ 4.0.0-RC1, < 4.5.11`	`3.9.64.5.11`
craft cms craftcms	`≥ 3.0.0, < 3.9.6≥ 4.0.0, ≤ 4.5.15`	`3.9.6`

概要

Impact

This is a potential moderate impact, low complexity privilege escalation vulnerability in Craft with certain user permissions setups.

Patches

This has been fixed in Craft 4.4.16 and Craft 3.9.6. Users should ensure they are running at least those versions.

References

https://github.com/craftcms/cms/pull/13932 https://github.com/craftcms/cms/pull/13931 https://github.com/craftcms/cms/blob/develop/CHANGELOG.md#4511---2023-11-16 https://github.com/craftcms/cms/blob/v3/CHANGELOG.md#396---2023-11-16

NVD の説明

Craft is a content management system. This is a potential moderate impact, low complexity privilege escalation vulnerability in Craft starting in 3.x prior to 3.9.6 and 4.x prior to 4.4.16 with certain user permissions setups. This has been fixed in Craft 4.4.16 and Craft 3.9.6. Users should ensure they are running at least those versions.