Skip to main content

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2024-24807

Medium
4.8/10

Summary

Sulu is a highly extensible open-source PHP content management system based on the Symfony framework. There is an issue when inputting HTML into the Tag name. The HTML is executed when the tag name is listed in the auto-complete form. Only admin users can create tags so they are the only ones affected. This issue affects sulu/sulu versions 2.0.0-alpha1 through 2.4.15 and 2.5.0-alpha1 through 2.5.11.

  • LOW
  • NETWORK
  • LOW
  • CHANGED
  • REQUIRED
  • HIGH
  • LOW
  • NONE

CWE-79 - Cross Site Scripting

Cross-Site Scripting, commonly referred to as XSS, is the most dominant class of vulnerabilities. It allows an attacker to inject malicious code into a pregnable web application and victimize its users. The exploitation of such a weakness can cause severe issues such as account takeover, and sensitive data exfiltration. Because of the prevalence of XSS vulnerabilities and their high rate of exploitation, it has remained in the OWASP top 10 vulnerabilities for years.

References

Advisory Timeline

  • Published