CVE-2024-47617
1 advisory.
Packagist/sulu/sulu CVE-2024-47617: medium 6.1
Injection of arbitrary HTML/JavaScript code through the media download URL
Action: Upgrade sulu/sulu to 2.5.21 or later.
composer require sulu/sulu:2.6.5composer require sulu/sulu:2.5.21Affected
| introduced | fixed | last affected |
|---|---|---|
| 2.6.0 | 2.6.5 | - |
| 2.0.0 | 2.5.21 | - |
Fixed versions
| 2.6.5 | 2.5.21 |
Sources
- osv: GHSA-6784-9c82-vr85
- https://github.com/sulu/sulu/security/advisories/GHSA-6784-9c82-vr85
- https://nvd.nist.gov/vuln/detail/CVE-2024-47617
- https://github.com/sulu/sulu/commit/a5a5ae555d282e88ff8559d38cfb46dea7939bda
- https://github.com/sulu/sulu/commit/eeacd14b6cf55f710084788140d40ebb00314b29
- https://github.com/sulu/sulu
- https://github.com/sulu/sulu/blob/2.6/src/Sulu/Bundle/MediaBundle/Controller/MediaStreamController.php#L106
CVE-2024-47617 · published · modified · JSON