CVE-2024-0776 is a problematic cross-site scripting (XSS) vulnerability identified in pb-cms versions 2.0. This flaw allows attackers to inject malicious scripts, potentially compromising user sessions and data integrity. The vulnerability resides within the Comment Handler component and is triggered by manipulating input with a specific payload. A fix is available in version 2.0.1.
Successful exploitation of CVE-2024-0776 allows an attacker to execute arbitrary JavaScript code within the context of a victim's browser session. This can lead to various malicious actions, including stealing cookies, redirecting users to phishing sites, or defacing the website. The remote nature of the vulnerability means an attacker doesn't need local access to exploit it. The impact is amplified if the pb-cms installation handles sensitive user data or financial transactions, as attackers could potentially gain access to this information. While the CVSS score is LOW, the ease of exploitation and potential for session hijacking make this a significant risk.
This vulnerability has been publicly disclosed and a proof-of-concept may be available. The CVSS score indicates a low probability of exploitation, but the ease of exploitation means that attackers could quickly leverage this vulnerability if they discover an unpatched instance of pb-cms. No active campaigns or KEV listing are currently associated with this CVE as of the publication date.
Exploit Status
EPSS
0.08% (23% percentile)
CVSS Vector
The primary mitigation for CVE-2024-0776 is to immediately upgrade pb-cms to version 2.0.1, which contains the fix. If upgrading is not immediately feasible, consider implementing input validation and sanitization on the Comment Handler to prevent the injection of malicious scripts. Web Application Firewalls (WAFs) configured to detect and block XSS payloads can provide an additional layer of defense. Regularly review and update security rules to reflect the latest threat landscape. After upgrade, confirm the vulnerability is resolved by attempting to inject the test payload (<div onmouseenter="alert("xss")">) and verifying that the alert does not trigger.
Update pb-cms to a version later than 2.0 that fixes the XSS vulnerability. Consult the vendor's website for the latest version and upgrade instructions.
Vulnerability analysis and critical alerts directly to your inbox.
CVE-2024-0776 is a cross-site scripting (XSS) vulnerability in pb-cms version 2.0, allowing attackers to inject malicious scripts via the Comment Handler.
If you are using pb-cms version 2.0, you are potentially affected. Upgrade to version 2.0.1 to mitigate the risk.
Upgrade pb-cms to version 2.0.1. If upgrading is not possible, implement input validation and sanitization on the Comment Handler.
While no active campaigns are confirmed, the vulnerability has been publicly disclosed and a proof-of-concept may be available, increasing the risk of exploitation.
Refer to the pb-cms project's official website or repository for the latest security advisories and updates.
Upload your dependency file and we'll tell you instantly if this and other CVEs hit you.