CVE-2024-52292
CVSS 3.1 Score 7.7 of 10 (high)
Details
Published Nov 13, 2024
Updated: Nov 15, 2024
CWE ID 22
CWE ID 552
Summary
CVE-2024-52292 is a vulnerability affecting the Craft content management system. This issue arises when the dataUrl function is exploited, allowing attackers with write permissions on system notification templates to embed this function. By doing so, they can exfiltrate the Base64-encoded content of arbitrary files on the server. The vulnerability is exploited through triggered system email notifications, which enable attackers to decode and read the files once received. The vulnerability has been addressed in Craft versions 5.4.9 and 4.12.8.
Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.
Affected Products
- CMs
Affected Vendors
- Pluck -