medium5.4
CVE-2024-21622
Craft CMS Privilege Escalation
Impact
### Impact This is a potential moderate impact, low complexity privilege escalation vulnerability in Craft with certain user permissions setups. ### Patches This has been fixed in Craft 4.4.16 and Craft 3.9.6. Users should ensure they are running at least those versions. ### References https://github.com/craftcms/cms/pull/13932 https://github.com/craftcms/cms/pull/13931 https://github.com/craftcms/cms/blob/develop/CHANGELOG.md#4511---2023-11-16 https://github.com/craftcms/cms/blob/v3/CHANGELOG.md#396---2023-11-16
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| composer | craftcms/cms | >= 4.0.0-RC1, <= 4.5.10 | 4.5.11 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Craftcms | Craft Cms | from 3.0.0 before 3.9.6 from 4.0.0 through 4.5.15 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://github.com/craftcms/cms/blob/develop/CHANGELOG.md#4511---2023-11-16
- https://github.com/craftcms/cms/blob/v3/CHANGELOG.md#396---2023-11-16
- https://github.com/craftcms/cms/commit/76caf9af07d9964be0fd362772223be6a5f5b6aa
- https://github.com/craftcms/cms/commit/be81eb653d633833f2ab22510794abb6bb9c0843
- https://github.com/craftcms/cms/pull/13931
- https://github.com/craftcms/cms/pull/13932
- https://github.com/craftcms/cms/security/advisories/GHSA-j5g9-j7r4-6qvx
- https://github.com/advisories/GHSA-j5g9-j7r4-6qvx
- https://nvd.nist.gov/vuln/detail/CVE-2024-21622