CVE-2024-55342 - A file upload functionality in Piranha CMS 11.1 allows authenticated remote attackers to upload a crafted PDF file to /manager/media

Back Back to CVE browser

MEDIUM

A file upload functionality in Piranha CMS 11.1 allows authenticated remote attackers to upload a crafted PDF file to /manager/media

Published Dec 20, 2024

4.7

MEDIUM

CVSS 3.1

EPSS 0.51%

Description

A file upload functionality in Piranha CMS 11.1 allows authenticated remote attackers to upload a crafted PDF file to /manager/media. This PDF can contain malicious JavaScript code, which is executed when a victim user opens or interacts with the PDF in their web browser, leading to a XSS vulnerability.

Affected products

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-79

Cross-site Scripting (XSS)

References (5)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2024-3578
Advisory
https://github.com/PiranhaCMS/piranha.core
Product
https://github.com/advisories/GHSA-cmwp-442x-3rcv
Advisory
https://nvd.nist.gov/vuln/detail/CVE-2024-55342
https://sec-fortress.github.io/posts/articles/posts/CVE-2024-55342.html
ExploitThird Party Advisory

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2024-3578		Advisory
https://github.com/PiranhaCMS/piranha.core		Product
https://github.com/advisories/GHSA-cmwp-442x-3rcv		Advisory
https://nvd.nist.gov/vuln/detail/CVE-2024-55342
https://sec-fortress.github.io/posts/articles/posts/CVE-2024-55342.html		ExploitThird Party Advisory