CVE-2024-53864: Cross-site Scripting in a field that is used in the Content name pattern in ibexa/admin-ui
First published: Fri Nov 29 2024(Updated: )
### Impact The Content name pattern is used to build Content names from one or more fields. An XSS vulnerability has been found in this mechanism. Content edit permission is required to exploit it. After the fix, any existing injected XSS will not run. ### Patches - See "Patched versions. - https://github.com/ibexa/admin-ui/commit/8ec824a8cf06c566ed88e4c21cc66f7ed42649fc ### Workarounds None. ### References - Advisory: https://developers.ibexa.co/security-advisories/ibexa-sa-2024-006-vulnerabilities-in-content-name-pattern-commerce-shop-and-varnish-vhost-templates - Release notes: https://doc.ibexa.co/en/latest/update_and_migration/from_4.6/update_from_4.6/#v4614
Credit: security-advisories@github.com security-advisories@github.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| composer/ibexa/admin-ui | >=4.6.0<4.6.14 | 4.6.14 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://github.com/ibexa/admin-ui/security/advisories/GHSA-8w3p-gf85-qcch
- https://github.com/ibexa/admin-ui/commit/8ec824a8cf06c566ed88e4c21cc66f7ed42649fc
- https://developers.ibexa.co/security-advisories/ibexa-sa-2024-006-vulnerabilities-in-content-name-pattern-commerce-shop-and-varnish-vhost-templates
- https://doc.ibexa.co/en/latest/update_and_migration/from_4.6/update_from_4.6/#v4614
- https://nvd.nist.gov/vuln/detail/CVE-2024-53864
- https://github.com/advisories/GHSA-8w3p-gf85-qcch (Advisory)
Frequently Asked Questions
What is the severity of CVE-2024-53864?
CVE-2024-53864 has a medium severity rating due to the potential for cross-site scripting (XSS) if exploited.
How do I fix CVE-2024-53864?
To fix CVE-2024-53864, update to the version 4.6.14 of the ibexa/admin-ui package.
What does CVE-2024-53864 exploit require?
CVE-2024-53864 requires content edit permissions to be exploited in the application.
What kind of vulnerability is CVE-2024-53864?
CVE-2024-53864 is an XSS vulnerability affecting the content name pattern functionality.
Will existing XSS injections remain after fixing CVE-2024-53864?
After applying the fix for CVE-2024-53864, any existing injected XSS will no longer execute.
- agent/weakness
- agent/title
- agent/first-publish-date
- agent/type
- collector/nvd-api
- source/NVD
- agent/severity
- collector/github-advisory-latest
- source/GitHub
- alias/GHSA-8w3p-gf85-qcch
- alias/CVE-2024-53864
- agent/software-canonical-lookup
- agent/references
- agent/last-modified-date
- agent/softwarecombine
- agent/description
- agent/event
- collector/nvd-cve
- agent/author
- collector/mitre-cve
- source/MITRE
- collector/github-advisory
- agent/trending
- agent/tags
- agent/source
- package-manager/composer