{"action":"Upgrade statamic/cms to 3.4.17 or later.","affected":[{"fixed":"4.46.0","introduced":"4.00"},{"fixed":"3.4.17","introduced":"0"}],"component":"statamic/cms","cve_ids":["CVE-2024-24570"],"ecosystem":"Packagist","epss":0.00734,"exploited":false,"fixed_versions":["4.46.0","3.4.17"],"ghsa_id":"GHSA-vqxq-hvxw-9mv9","id":"tcs_01M5KF9D0EFD8FV5YQE43ZEF0R","modified_at":"2026-09-10T03:50:10.031946575Z","published_at":"2024-02-01T20:51:46Z","references":["https://osv.dev/vulnerability/GHSA-vqxq-hvxw-9mv9","https://github.com/statamic/cms/security/advisories/GHSA-vqxq-hvxw-9mv9","https://nvd.nist.gov/vuln/detail/CVE-2024-24570","https://github.com/statamic/cms","http://packetstormsecurity.com/files/177133/Statamic-CMS-Cross-Site-Scripting.html","http://seclists.org/fulldisclosure/2024/Feb/17"],"severity":{"label":"high","score":8.2},"sources":[{"source":"osv","source_id":"GHSA-vqxq-hvxw-9mv9","url":"https://osv.dev/vulnerability/GHSA-vqxq-hvxw-9mv9"}],"summary":"Statmic CMS vulnerable to account takeover via XSS and password reset link"}