Platform
php
Component
cms
Fixed in
4.0.1
3.0.1
CVE-2024-21622 is a privilege escalation vulnerability discovered in Craft CMS, a content management system. This flaw allows attackers with specific user permissions to potentially elevate their privileges within the system, leading to unauthorized access and control. The vulnerability affects versions 3.0.0–>= 4.0.0-RC1 and those prior to 4.5.11. A fix is available in Craft CMS versions 4.4.16 and 3.9.6.
Successful exploitation of CVE-2024-21622 could grant an attacker elevated privileges within a Craft CMS installation. This could allow them to modify sensitive data, install malicious code, or gain complete control over the affected website. The impact is particularly severe for installations with poorly configured user permissions, where an attacker might be able to exploit this vulnerability to bypass access controls. While the description doesn't detail specific attack vectors, the potential for privilege escalation suggests a significant risk to data integrity and system security.
CVE-2024-21622 was publicly disclosed on January 3, 2024. There is currently no indication of active exploitation in the wild, nor are there any publicly available proof-of-concept exploits. The vulnerability is not listed on the CISA KEV catalog at the time of this writing. The vulnerability's impact is contingent on specific user permission configurations, which may limit its exploitability in some environments.
Exploit Status
EPSS
0.10% (28% percentile)
CVSS Vector
The primary mitigation for CVE-2024-21622 is to upgrade Craft CMS to version 4.4.16 or 3.9.6, as these versions contain the necessary fix. If an immediate upgrade is not feasible, review and tighten user permission configurations within Craft CMS to minimize the potential impact of this vulnerability. Ensure that users are granted only the minimum necessary privileges. Consider implementing a Web Application Firewall (WAF) with rules to detect and block suspicious requests targeting potential privilege escalation attempts. After upgrade, confirm the fix by attempting to access restricted resources with a user account that previously had limited permissions.
Actualice Craft CMS a la versión 4.4.16 o superior, o a la versión 3.9.6 o superior. Esto solucionará la vulnerabilidad de escalada de privilegios. Realice una copia de seguridad antes de actualizar.
Vulnerability analysis and critical alerts directly to your inbox.
CVE-2024-21622 is a medium severity privilege escalation vulnerability in Craft CMS affecting versions 3.0.0–>= 4.0.0-RC1 and < 4.5.11. Attackers with specific permissions could elevate their privileges.
You are affected if you are using Craft CMS versions 3.0.0–>= 4.0.0-RC1 and < 4.5.11. Check your version and upgrade if necessary.
Upgrade Craft CMS to version 4.4.16 or 3.9.6. Review and tighten user permission configurations to minimize potential impact.
There is currently no indication of active exploitation in the wild or publicly available proof-of-concept exploits.
Refer to the official Craft CMS security advisory for details: [https://craftcms.com/security/bulletins/cve-2024-21622](https://craftcms.com/security/bulletins/cve-2024-21622)
Upload your dependency file and we'll tell you instantly if this and other CVEs hit you.