Craft CMS Privilege Escalation
### Impact This is a potential moderate impact, low complexity privilege escalation vulnerability in Craft with certain user permissions setups. ### Patches This has been fixed in Craft 4.4.16 and Craft 3.9.6. Users should ensure they are running at least those versions. ### References https://github.com/craftcms/cms/pull/13932 https://github.com/craftcms/cms/pull/13931 https://github.com/craftcms/cms/blob/develop/CHANGELOG.md#4511---2023-11-16 https://github.com/craftcms/cms/blob/v3/CHANGELOG.md#396---2023-11-16
describes (1)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2024-21622US | high8.8 | — | ||
Craft is a content management system. This is a potential moderate impact, low complexity privilege escalation vulnerability in Craft starting in 3.x prior to 3.9.6 and 4.x prior t… | ||||
references
External citations — patches, advisories, analysis.
- https://github.com/craftcms/cmsPACKAGE
- https://github.com/craftcms/cms/blob/develop/CHANGELOG.md#4511---2023-11-16WEB
- https://github.com/craftcms/cms/blob/v3/CHANGELOG.md#396---2023-11-16WEB
- https://github.com/craftcms/cms/commit/76caf9af07d9964be0fd362772223be6a5f5b6aaWEB
- https://github.com/craftcms/cms/commit/be81eb653d633833f2ab22510794abb6bb9c0843WEB
- https://github.com/craftcms/cms/pull/13931WEB
- https://github.com/craftcms/cms/pull/13932WEB
- https://github.com/craftcms/cms/security/advisories/GHSA-j5g9-j7r4-6qvxWEB
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan