CVE-2024-24570

Summary

CVE-2024-24570 is a vulnerability affecting Statamic, a Laravel and Git-powered CMS. Maliciously crafted files disguised as JPG images can be uploaded via front-end forms with unvalidated asset fields, as well as in the control panel and asset browser. This leads to Cross-Site Scripting (XSS) attacks. If the XSS is executed in a specific manner, attackers can exploit the "copy password reset link" feature to obtain a user's password reset token and gain unauthorized access to their account. The vulnerability is addressed in versions 4.46.0 and 3.4.17, with asset fields mime type validation added, and the copy password reset link functionality being disabled.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.