CVE-2024-47617: Reflected XSS Vulnerability in Sulu Media Bundle
Impact
This vulnerability allows an attacker to inject arbitrary HTML/JavaScript code through the media download URL in Sulu CMS. It affects the SuluMediaBundle component. The vulnerability is a Reflected Cross-Site Scripting (XSS) issue, which could potentially allow attackers to steal sensitive information, manipulate the website's content, or perform actions on behalf of the victim.
Patches
The problem has not been patched yet. Users should upgrade to patched versions once they become available. Currently affected versions are:
2.6.4 2.5.20
Workarounds
Until an official patch is released, users can implement additional input validation and output encoding for the 'slug' parameter in the MediaStreamController's downloadAction method. Alternatively, configuring a Web Application Firewall (WAF) to filter potentially malicious input could serve as a temporary mitigation.
References
GitHub repository: https://github.com/sulu/sulu Vulnerable code: https://github.com/sulu/sulu/blob/2.6/src/Sulu/Bundle/MediaBundle/Controller/MediaStreamController.php#L106
Other sources
Sulu is a PHP content management system. This vulnerability allows an attacker to inject arbitrary HTML/JavaScript code through the media download URL in Sulu CMS. It affects the SuluMediaBundle component. The vulnerability is a Reflected Cross-Site Scripting (XSS) issue, which could potentially allow attackers to steal sensitive information, manipulate the website's content, or perform actions on behalf of the victim. This vulnerability is fixed in 2.6.5 and 2.5.21.
— MITRE
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2024-47617?
CVE-2024-47617 is a Reflected Cross-Site Scripting (XSS) vulnerability.
How do I fix CVE-2024-47617?
To fix CVE-2024-47617, upgrade Sulu CMS to version 2.5.21 or 2.6.5.
What components are affected by CVE-2024-47617?
CVE-2024-47617 affects the SuluMediaBundle component of the Sulu CMS.
Can CVE-2024-47617 lead to data theft?
Yes, CVE-2024-47617 can allow attackers to inject malicious code, potentially leading to data theft.
Who is at risk from CVE-2024-47617?
Users of Sulu CMS versions 2.5.20 and 2.6.4 are at risk from CVE-2024-47617.