CVE-2024-47618: Sulu vulnerable to XSS via uploaded SVG
In Sulu v2.0.0 through v2.6.4 are vulnerable against XSS whereas a low privileged user with an access to the “Media” section can upload an SVG file with a malicious payload. Once uploaded and accessed, the malicious javascript will be executed on the victims’ (other users including admins) browsers.
Other sources
Sulu is a PHP content management system. Sulu is vulnerable against XSS whereas a low privileged user with access to the “Media” section can upload an SVG file with a malicious payload. Once uploaded and accessed, the malicious javascript will be executed on the victims’ (other users including admins) browsers. This issue is fixed in 2.6.5.
— MITRE
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2024-47618?
CVE-2024-47618 is classified as a low severity vulnerability that allows XSS exploitation through SVG file uploads.
How do I fix CVE-2024-47618?
To fix CVE-2024-47618, upgrade Sulu to version 2.6.5 or 2.5.21.
Which versions of Sulu are affected by CVE-2024-47618?
CVE-2024-47618 affects Sulu versions from 2.0.0 to 2.6.4.
What type of vulnerability is CVE-2024-47618?
CVE-2024-47618 is an XSS (Cross-Site Scripting) vulnerability.
Who can exploit CVE-2024-47618?
A low privileged user with access to the Media section can exploit CVE-2024-47618.