CVE-2024-0776 is a problematic cross-site scripting (XSS) vulnerability identified in pb-cms versions 2.0. This flaw allows attackers to inject malicious scripts, potentially compromising user sessions and data integrity. The vulnerability resides within the Comment Handler component and is triggered by manipulating input with a specific payload. A fix is available in version 2.0.1.
Impact and Attack Scenarios
Successful exploitation of CVE-2024-0776 allows an attacker to execute arbitrary JavaScript code within the context of a victim's browser session. This can lead to various malicious actions, including stealing cookies, redirecting users to phishing sites, or defacing the website. The remote nature of the vulnerability means an attacker doesn't need local access to exploit it. The impact is amplified if the pb-cms installation handles sensitive user data or financial transactions, as attackers could potentially gain access to this information. While the CVSS score is LOW, the ease of exploitation and potential for session hijacking make this a significant risk.
Exploitation Context
This vulnerability has been publicly disclosed and a proof-of-concept may be available. The CVSS score indicates a low probability of exploitation, but the ease of exploitation means that attackers could quickly leverage this vulnerability if they discover an unpatched instance of pb-cms. No active campaigns or KEV listing are currently associated with this CVE as of the publication date.
Threat Intelligence
Exploit Status
EPSS
0.08% (23% percentile)
CVSS Vector
What do these metrics mean?
- Attack Vector
- Network — remotely exploitable over the internet. No physical or local access required. Widest attack surface.
- Attack Complexity
- Low — no special conditions required. Attacker can exploit reliably without depending on rare configurations or timing.
- Privileges Required
- Low — any valid user account is sufficient. Basic authenticated access required.
- User Interaction
- Required — victim must take an action: open a file, click a link, or visit a crafted page.
- Scope
- Unchanged — impact is limited to the vulnerable component itself.
- Confidentiality
- None — no confidentiality impact. Attacker cannot read protected data.
- Integrity
- Low — attacker can modify some data with limited scope or impact.
- Availability
- None — no availability impact. Service remains fully operational.
Affected Software
Weakness Classification (CWE)
Timeline
- Reserved
- Published
- Modified
- EPSS updated
Mitigation and Workarounds
The primary mitigation for CVE-2024-0776 is to immediately upgrade pb-cms to version 2.0.1, which contains the fix. If upgrading is not immediately feasible, consider implementing input validation and sanitization on the Comment Handler to prevent the injection of malicious scripts. Web Application Firewalls (WAFs) configured to detect and block XSS payloads can provide an additional layer of defense. Regularly review and update security rules to reflect the latest threat landscape. After upgrade, confirm the vulnerability is resolved by attempting to inject the test payload (<div onmouseenter="alert("xss")">) and verifying that the alert does not trigger.
How to fix
Update pb-cms to a version later than 2.0 that fixes the XSS vulnerability. Consult the vendor's website for the latest version and upgrade instructions.
CVE Security Newsletter
Vulnerability analysis and critical alerts directly to your inbox.
Frequently asked questions
What is CVE-2024-0776 — XSS in pb-cms 2.0?
CVE-2024-0776 is a cross-site scripting (XSS) vulnerability in pb-cms version 2.0, allowing attackers to inject malicious scripts via the Comment Handler.
Am I affected by CVE-2024-0776 in pb-cms 2.0?
If you are using pb-cms version 2.0, you are potentially affected. Upgrade to version 2.0.1 to mitigate the risk.
How do I fix CVE-2024-0776 in pb-cms 2.0?
Upgrade pb-cms to version 2.0.1. If upgrading is not possible, implement input validation and sanitization on the Comment Handler.
Is CVE-2024-0776 being actively exploited?
While no active campaigns are confirmed, the vulnerability has been publicly disclosed and a proof-of-concept may be available, increasing the risk of exploitation.
Where can I find the official pb-cms advisory for CVE-2024-0776?
Refer to the pb-cms project's official website or repository for the latest security advisories and updates.
Is your project affected?
Upload your dependency file and we'll tell you instantly if this and other CVEs hit you.