Plattform
php
Komponente
bughub
Behoben in
2.0.1
CVE-2024-0776 is a problematic cross-site scripting (XSS) vulnerability identified in pb-cms versions 2.0. This flaw allows attackers to inject malicious scripts, potentially compromising user sessions and data integrity. The vulnerability resides within the Comment Handler component and is triggered by manipulating input with a specific payload. A fix is available in version 2.0.1.
Successful exploitation of CVE-2024-0776 allows an attacker to execute arbitrary JavaScript code within the context of a victim's browser session. This can lead to various malicious actions, including stealing cookies, redirecting users to phishing sites, or defacing the website. The remote nature of the vulnerability means an attacker doesn't need local access to exploit it. The impact is amplified if the pb-cms installation handles sensitive user data or financial transactions, as attackers could potentially gain access to this information. While the CVSS score is LOW, the ease of exploitation and potential for session hijacking make this a significant risk.
This vulnerability has been publicly disclosed and a proof-of-concept may be available. The CVSS score indicates a low probability of exploitation, but the ease of exploitation means that attackers could quickly leverage this vulnerability if they discover an unpatched instance of pb-cms. No active campaigns or KEV listing are currently associated with this CVE as of the publication date.
Websites and applications utilizing pb-cms version 2.0 are at risk. This includes developers who have integrated pb-cms into their projects and hosting providers who manage pb-cms installations for their clients. Shared hosting environments are particularly vulnerable as multiple websites may be affected by a single instance of the vulnerable software.
• php: Examine pb-cms configuration files for any custom sanitization routines that might be bypassed.
• generic web: Monitor access logs for unusual requests containing the payload <div onmouseenter="alert("xss")">.
• generic web: Check response headers for signs of script injection (e.g., unexpected Content-Security-Policy directives).
disclosure
Exploit-Status
EPSS
0.08% (23% Perzentil)
CVSS-Vektor
The primary mitigation for CVE-2024-0776 is to immediately upgrade pb-cms to version 2.0.1, which contains the fix. If upgrading is not immediately feasible, consider implementing input validation and sanitization on the Comment Handler to prevent the injection of malicious scripts. Web Application Firewalls (WAFs) configured to detect and block XSS payloads can provide an additional layer of defense. Regularly review and update security rules to reflect the latest threat landscape. After upgrade, confirm the vulnerability is resolved by attempting to inject the test payload (<div onmouseenter="alert("xss")">) and verifying that the alert does not trigger.
Actualice pb-cms a una versión posterior a la 2.0 que corrija la vulnerabilidad XSS. Consulte el sitio web del proveedor para obtener la última versión y las instrucciones de actualización.
Schwachstellenanalysen und kritische Warnungen direkt in deinen Posteingang.
CVE-2024-0776 is a cross-site scripting (XSS) vulnerability in pb-cms version 2.0, allowing attackers to inject malicious scripts via the Comment Handler.
If you are using pb-cms version 2.0, you are potentially affected. Upgrade to version 2.0.1 to mitigate the risk.
Upgrade pb-cms to version 2.0.1. If upgrading is not possible, implement input validation and sanitization on the Comment Handler.
While no active campaigns are confirmed, the vulnerability has been publicly disclosed and a proof-of-concept may be available, increasing the risk of exploitation.
Refer to the pb-cms project's official website or repository for the latest security advisories and updates.
Lade deine Abhängigkeitsdatei hoch und erfahre sofort, ob dich diese und andere CVEs treffen.