Craft CMS Privilege Escalation

CAO 8.8CVE-2024-21622 · GHSA-j5g9-j7r4-6qvx · Công bố 03/01/2024 · cập nhật 17/06/2026

Tóm tắt nhanh

CVE-2024-21622 là lỗ hổng mức CAO (CVSS 8.8) ảnh hưởng craftcms/cms, craft cms (craftcms).
Xác suất bị khai thác trong 30 ngày tới (EPSS): 0.59%, cao hơn 48.1% các lỗ hổng khác.
Cách xử lý: cập nhật lên 3.9.6, 4.5.11 hoặc mới hơn.

Gói / sản phẩm	Phiên bản bị ảnh hưởng	Phiên bản đã vá
craftcms/cms Packagist	`≥ 3.0.0, < 3.9.6≥ 4.0.0-RC1, < 4.5.11`	`3.9.64.5.11`
craft cms craftcms	`≥ 3.0.0, < 3.9.6≥ 4.0.0, ≤ 4.5.15`	`3.9.6`

Mô tả

Impact

This is a potential moderate impact, low complexity privilege escalation vulnerability in Craft with certain user permissions setups.

Patches

This has been fixed in Craft 4.4.16 and Craft 3.9.6. Users should ensure they are running at least those versions.

References

https://github.com/craftcms/cms/pull/13932 https://github.com/craftcms/cms/pull/13931 https://github.com/craftcms/cms/blob/develop/CHANGELOG.md#4511---2023-11-16 https://github.com/craftcms/cms/blob/v3/CHANGELOG.md#396---2023-11-16

Mô tả của NVD

Craft is a content management system. This is a potential moderate impact, low complexity privilege escalation vulnerability in Craft starting in 3.x prior to 3.9.6 and 4.x prior to 4.4.16 with certain user permissions setups. This has been fixed in Craft 4.4.16 and Craft 3.9.6. Users should ensure they are running at least those versions.