What is GHSA-cmwp-442x-3rcv?

GHSA-cmwp-442x-3rcv is a security advisory published by GitHub Security Advisories with Medium severity. Piranha CMS Cross-site Scripting vulnerability

Which CVE IDs does GHSA-cmwp-442x-3rcv cover?

GHSA-cmwp-442x-3rcv covers the following CVE IDs: CVE-2024-55342. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-cmwp-442x-3rcv?

GHSA-cmwp-442x-3rcv has a CVSS v3 base score of 4.7, published by GitHub Security Advisories.

Which products are affected by GHSA-cmwp-442x-3rcv?

GHSA-cmwp-442x-3rcv affects 1 product, including: nuget/Piranha:\u003c= 11.1.0.

GHSA-cmwp-442x-3rcvMediumCVSS 4.7

Piranha CMS Cross-site Scripting vulnerability

Vendor

GitHub Security Advisories

Published

December 20, 2024

Last Modified

December 20, 2024

🔗 CVE IDs covered (1)

CVE-2024-55342 →

📋 Description

A file upload functionality in Piranha CMS 11.1 allows authenticated remote attackers to upload a crafted PDF file to /manager/media. This PDF can contain malicious JavaScript code, which is executed when a victim user opens or interacts with the PDF in their web browser, leading to a XSS vulnerability.

🎯 Affected products1

nuget/Piranha:<= 11.1.0

🔗 References (4)

https://nvd.nist.gov/vuln/detail/CVE-2024-55342
https://github.com/PiranhaCMS/piranha.core
https://sec-fortress.github.io/posts/articles/posts/CVE-2024-55342.html
https://github.com/advisories/GHSA-cmwp-442x-3rcv