Mezzanine allows attackers to bypass access control mechanisms

Description

References

• nvd.nist.gov/vuln/detail/CVE-2024-25169 · ADVISORY
• shenhav12/CVE-2024-25169-Mezzanine-v6.0.0 · WEB
• stephenmcd/mezzanine · PACKAGE
• ibb.co/JKh4hmD · WEB
• ibb.co/Pt9qd8t · WEB
• ibb.co/hLLPTVp · WEB
• ibb.co/rfrKj3r · WEB
• pypi.org/project/mezzanine · PACKAGE
• GitHub Advisory GHSA-qp56-82vp-xqgv · ADVISORY

mezzanine 的其他漏洞

• CVE-2025-50481中危 4.8A cross-site scripting (XSS) vulnerability in the component /blog/blogpost/add of Mezzanine CMS v6.1.0 allows attackers to execute arbitrary…
• CVE-2025-6050中危 4.8Mezzanine CMS, in versions prior to 6.1.1, contains a Stored Cross-Site Scripting (XSS) vulnerability in the admin interface. The vulnerabil…
• CVE-2025-29573中危 6.1Cross-Site Scripting (XSS) vulnerability exists in Mezzanine CMS 6.0.0 in the "View Entries" feature within the Forms module.
• CVE-2024-25170严重 9.1An issue in Mezzanine v6.0.0 allows attackers to bypass access controls via manipulating the Host header.
• CVE-2020-19002中危 6.1Cross Site Scripting (XSS) in Mezzanine v4.3.1 allows remote attackers to execute arbitrary code via the 'Description' field of the componen…