Cross-site Scripting via uploaded SVG

中 5.4CVE-2024-47618 · GHSA-255w-87rh-rg44 · 03/10/2024 公開 · 17/06/2026 更新

要点

CVE-2024-47618 は sulu/sulu, sulu (sulu) に影響する深刻度「中」 (CVSS 5.4) の脆弱性です。
今後30日間に悪用される確率（EPSS）：0.35%（全脆弱性の 28.7% より高い）。
対処：2.5.21, 2.6.5 以降に更新してください。

パッケージ	影響を受けるバージョン	修正済みバージョン
sulu/sulu Packagist	`≥ 2.0.0-RC1, < 2.5.21≥ 2.6.0-RC1, < 2.6.5`	`2.5.212.6.5`
sulu sulu	`= 2.0.0> 2.0.0, < 2.6.5`	`2.6.5`

概要

In Sulu v2.0.0 through v2.6.4 are vulnerable against XSS whereas a low privileged user with an access to the “Media” section can upload an SVG file with a malicious payload. Once uploaded and accessed, the malicious javascript will be executed on the victims’ (other users including admins) browsers.

NVD の説明

Sulu is a PHP content management system. Sulu is vulnerable against XSS whereas a low privileged user with access to the “Media” section can upload an SVG file with a malicious payload. Once uploaded and accessed, the malicious javascript will be executed on the victims’ (other users including admins) browsers. This issue is fixed in 2.6.5.