{"action":"Upgrade sulu/sulu to 2.5.21 or later.","affected":[{"fixed":"2.6.5","introduced":"2.6.0"},{"fixed":"2.5.21","introduced":"2.0.0"}],"component":"sulu/sulu","cve_ids":["CVE-2024-47617"],"ecosystem":"Packagist","epss":0.00394,"exploited":false,"fixed_versions":["2.6.5","2.5.21"],"ghsa_id":"GHSA-6784-9c82-vr85","id":"tcs_01M5KEWSR4NBDP13X9MDAR8ETD","modified_at":"2024-10-17T17:05:46.839857Z","published_at":"2024-10-03T18:26:26Z","references":["https://osv.dev/vulnerability/GHSA-6784-9c82-vr85","https://github.com/sulu/sulu/security/advisories/GHSA-6784-9c82-vr85","https://nvd.nist.gov/vuln/detail/CVE-2024-47617","https://github.com/sulu/sulu/commit/a5a5ae555d282e88ff8559d38cfb46dea7939bda","https://github.com/sulu/sulu/commit/eeacd14b6cf55f710084788140d40ebb00314b29","https://github.com/sulu/sulu","https://github.com/sulu/sulu/blob/2.6/src/Sulu/Bundle/MediaBundle/Controller/MediaStreamController.php#L106"],"severity":{"label":"medium","score":6.1},"sources":[{"source":"osv","source_id":"GHSA-6784-9c82-vr85","url":"https://osv.dev/vulnerability/GHSA-6784-9c82-vr85"}],"summary":"Injection of arbitrary HTML/JavaScript code through the media download URL"}