CVE-2024-24807: Sulu is vulnerable to HTML Injection via Autocomplete Suggestion
Impact
It is an issue when input HTML into the Tag name. The HTML is execute when the tag name is listed in the auto complete form. Only admin users are affected and only admin users can create tags.
Patches
Has the problem been patched? What versions should users upgrade to?
The problem is patched with Version 2.4.16 and 2.5.12.
Workarounds Is there a way for users to fix or remediate the vulnerability without upgrading?
Create a custom mutation observer
References Are there any links users can visit to find out more?
Currently not.
For more information
If you have any questions or comments about this advisory:
- Open an issue in sulu/sulu repository - Email us at security@sulu.io
Other sources
Sulu is a highly extensible open-source PHP content management system based on the Symfony framework. There is an issue when inputting HTML into the Tag name. The HTML is executed when the tag name is listed in the auto complete form. Only admin users can create tags so they are the only ones affected. The problem is patched with version(s) 2.4.16 and 2.5.12.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
composer/sulu/suluto a version that resolves this vulnerability.Fixed in 2.5.12 - Upgrade
Upgrade
composer/sulu/suluto a version that resolves this vulnerability.Fixed in 2.4.16 - Upgrade
Upgrade
suluto a version that resolves this vulnerability.Fixed in 2.4.16 - Upgrade
Upgrade
suluto a version that resolves this vulnerability.Fixed in 2.5.12
Event History
Frequently Asked Questions
What is the severity of CVE-2024-24807?
CVE-2024-24807 has a high severity as it allows HTML code execution through tag names by admin users.
Who is affected by CVE-2024-24807?
Only admin users of the Sulu CMS are affected by CVE-2024-24807.
How do I fix CVE-2024-24807?
To fix CVE-2024-24807, upgrade to Sulu version 2.5.12 or 2.4.16.
What versions of Sulu are vulnerable to CVE-2024-24807?
Sulu versions between 2.0.0 and 2.4.16 and between 2.5.0 and 2.5.12 are vulnerable to CVE-2024-24807.
Can non-admin users exploit CVE-2024-24807?
No, non-admin users cannot exploit CVE-2024-24807 as only admin users can create tags.