Skip to content
Log inStart free trial

GHSA-j5g9-j7r4-6qvx CVE-2024-21622

Craft CMS Privilege Escalation

High Packagist
Severity
5.4 / 10
High · CVSS 3.1
Exploit chance (EPSS)
0.59%
Chance of exploitation in the next 30 days. Higher than 48.12% of scored vulnerabilities.
Known exploited
No
Not in CISA's catalog
Weakness
CWE-269 Improper Privilege Management
Fix
4.5.11
Upgrade craftcms/cms to this version or later

Description

Impact

This is a potential moderate impact, low complexity privilege escalation vulnerability in Craft with certain user permissions setups.

Patches

This has been fixed in Craft 4.4.16 and Craft 3.9.6. Users should ensure they are running at least those versions.

References

https://github.com/craftcms/cms/pull/13932 https://github.com/craftcms/cms/pull/13931 https://github.com/craftcms/cms/blob/develop/CHANGELOG.md#4511---2023-11-16 https://github.com/craftcms/cms/blob/v3/CHANGELOG.md#396---2023-11-16

Affected versions

Packagist

PackageVulnerableFixed in
craftcms/cms
>= 4.0.0-RC1, < 4.5.11
4.5.11
craftcms/cms
>= 3.0.0, < 3.9.6
3.9.6

How to fix

Move to the fixed version or later with your package manager, update the lockfile, and run your tests. If the package only arrives through another dependency, upgrade that dependency first. If none of its releases pulls a fixed version yet, force the version with your package manager's override.

craftcms/cms Packagist → 4.5.11

composer
composer require craftcms/cms:^4.5.11

Severity breakdown

CVSS 3.1 5.4

CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:L

Attack vector
Adjacent
Attack complexity
Low
Privileges required
Low
User interaction
None
Scope
Changed
Confidentiality
None
Integrity
Low
Availability
Low

Weakness

CWE-269: Improper Privilege Management

The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.

How to prevent it
  • Architecture and Design, Operation: Very carefully manage the setting, management, and handling of privileges. Explicitly manage trust zones in the software.
  • Architecture and Design: Follow the principle of least privilege when assigning access rights to entities in a software system.
  • Architecture and Design: Consider following the principle of separation of privilege. Require multiple conditions to be met before permitting access to a system resource.

References

Advisories

Packages

Other links

Timeline

  1. Published
  2. Last updated by the source
  3. Latest EPSS score
AdvisorySeverityWhy it's related
GHSA-7vrx-9684-xrf2
Craft CMS stores arbitrary content provided by unauthenticated users in session files
Medium Known exploited Also affects craftcms/cms
GHSA-f3gw-9ww9-jmc3
Craft CMS Allows Remote Code Execution
Critical Known exploited Also affects craftcms/cms
GHSA-x684-96hh-833x
Craft CMS has a potential RCE with a compromised security key
High Known exploited Also affects craftcms/cms
GHSA-2p6p-9rc9-62j9
Craft CMS has potential RCE when PHP `register_argc_argv` config setting is enabled
Critical Known exploited Also affects craftcms/cms
GHSA-wg23-69c2-gjc8
Craft CMS: Passkey login accepts replayed WebAuthn assertions
Medium Also affects craftcms/cms
GHSA-957r-qf9p-67xw
Craft CMS: Arbitrary file read via SplFileObject in non-sandboxed template contexts
Medium Also affects craftcms/cms
GHSA-596p-6jv8-775v
Craft CMS: Authenticated leak of secret environment variables
Medium Also affects craftcms/cms
GHSA-xxpx-f366-4xpq
Craft CMS: Authorization bypass: view-only Categories user can modify category structure via structures/move-element
Medium Also affects craftcms/cms
Is this in your code?

MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.

Check your repos with MergeHarbor