CVE-2024-43369 (GCVE-0-2024-43369)
Vulnerability from cvelistv5 – Published: 2024-08-15 23:17 – Updated: 2024-08-16 14:05
VLAI?
Title
Persistent Cross-site Scripting in Ibexa RichText Field Type
Summary
Ibexa RichText Field Type is a Field Type for supporting rich formatted text stored in a structured XML format. In versions on the 4.6 branch prior to 4.6.10, the validator for the RichText fieldtype blocklists `javascript:` and `vbscript:` in links to prevent XSS. This can leave other options open, and the check can be circumvented using upper case. Content editing permissions for RichText content is required to exploit this vulnerability, which typically means Editor role or higher. The fix implements an allowlist instead, which allows only approved link protocols. The new check is case insensitive. Version 4.6.10 contains a patch for this issue. No known workarounds are available.
Severity ?
7.2 (High)
CWE
- CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Assigner
References
| URL | Tags | ||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| ibexa | fieldtype-richtext |
Affected:
>= 4.6.0, < 4.6.10
|
{
"containers": {
"adp": [
{
"affected": [
{
"cpes": [
"cpe:2.3:a:ibexa:fieldtype-richtext:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "fieldtype-richtext",
"vendor": "ibexa",
"versions": [
{
"lessThan": "4.6.10",
"status": "affected",
"version": "4.6",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:a:ibexa:ezplatform-richtext:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "ezplatform-richtext",
"vendor": "ibexa",
"versions": [
{
"lessThan": "3.3.40",
"status": "affected",
"version": "3.3",
"versionType": "custom"
}
]
}
],
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-43369",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-08-16T13:57:12.758236Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-08-16T14:05:43.757Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "fieldtype-richtext",
"vendor": "ibexa",
"versions": [
{
"status": "affected",
"version": "\u003e= 4.6.0, \u003c 4.6.10"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Ibexa RichText Field Type is a Field Type for supporting rich formatted text stored in a structured XML format. In versions on the 4.6 branch prior to 4.6.10, the validator for the RichText fieldtype blocklists `javascript:` and `vbscript:` in links to prevent XSS. This can leave other options open, and the check can be circumvented using upper case. Content editing permissions for RichText content is required to exploit this vulnerability, which typically means Editor role or higher. The fix implements an allowlist instead, which allows only approved link protocols. The new check is case insensitive. Version 4.6.10 contains a patch for this issue. No known workarounds are available."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.2,
"baseSeverity": "HIGH",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79: Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-08-15T23:17:19.044Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/ibexa/fieldtype-richtext/security/advisories/GHSA-hvcf-6324-cjh7",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/ibexa/fieldtype-richtext/security/advisories/GHSA-hvcf-6324-cjh7"
},
{
"name": "https://github.com/ezsystems/ezplatform-richtext/security/advisories/GHSA-rhm7-7469-rcpw",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/ezsystems/ezplatform-richtext/security/advisories/GHSA-rhm7-7469-rcpw"
},
{
"name": "https://github.com/ibexa/fieldtype-richtext/commit/0a3b830e8806d5169f697351fdc48ffd95a25c67",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/ibexa/fieldtype-richtext/commit/0a3b830e8806d5169f697351fdc48ffd95a25c67"
},
{
"name": "https://github.com/ibexa/fieldtype-richtext/commit/59e9c1a9da60597f60cf7338bf289dccaa7e27ca",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/ibexa/fieldtype-richtext/commit/59e9c1a9da60597f60cf7338bf289dccaa7e27ca"
},
{
"name": "https://developers.ibexa.co/security-advisories/ibexa-sa-2024-005-persistent-xss-in-richtext",
"tags": [
"x_refsource_MISC"
],
"url": "https://developers.ibexa.co/security-advisories/ibexa-sa-2024-005-persistent-xss-in-richtext"
}
],
"source": {
"advisory": "GHSA-hvcf-6324-cjh7",
"discovery": "UNKNOWN"
},
"title": "Persistent Cross-site Scripting in Ibexa RichText Field Type"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2024-43369",
"datePublished": "2024-08-15T23:17:19.044Z",
"dateReserved": "2024-08-09T14:23:55.513Z",
"dateUpdated": "2024-08-16T14:05:43.757Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1",
"vulnerability-lookup:meta": {
"fkie_nvd": {
"descriptions": "[{\"lang\": \"en\", \"value\": \"Ibexa RichText Field Type is a Field Type for supporting rich formatted text stored in a structured XML format. In versions on the 4.6 branch prior to 4.6.10, the validator for the RichText fieldtype blocklists `javascript:` and `vbscript:` in links to prevent XSS. This can leave other options open, and the check can be circumvented using upper case. Content editing permissions for RichText content is required to exploit this vulnerability, which typically means Editor role or higher. The fix implements an allowlist instead, which allows only approved link protocols. The new check is case insensitive. Version 4.6.10 contains a patch for this issue. No known workarounds are available.\"}, {\"lang\": \"es\", \"value\": \" Ibexa RichText Field Type es un tipo de campo que admite texto enriquecido almacenado en un formato XML estructurado. En las versiones de la rama 4.6 anteriores a la 4.6.10, el validador para el tipo de campo RichText incluye listas de bloqueo `javascript:` y `vbscript:` en enlaces para evitar XSS. Esto puede dejar otras opciones abiertas y la verificaci\\u00f3n se puede omitir usando may\\u00fasculas. Se requieren permisos de edici\\u00f3n de contenido para contenido RichText para aprovechar esta vulnerabilidad, lo que normalmente significa la funci\\u00f3n de Editor o superior. En su lugar, la soluci\\u00f3n implementa una lista de permitidos, que solo permite protocolos de enlace aprobados. El nuevo cheque no distingue entre may\\u00fasculas y min\\u00fasculas. La versi\\u00f3n 4.6.10 contiene un parche para este problema. No hay soluciones conocidas disponibles.\"}]",
"id": "CVE-2024-43369",
"lastModified": "2024-08-19T13:00:23.117",
"metrics": "{\"cvssMetricV31\": [{\"source\": \"security-advisories@github.com\", \"type\": \"Secondary\", \"cvssData\": {\"version\": \"3.1\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N\", \"baseScore\": 7.2, \"baseSeverity\": \"HIGH\", \"attackVector\": \"NETWORK\", \"attackComplexity\": \"LOW\", \"privilegesRequired\": \"NONE\", \"userInteraction\": \"NONE\", \"scope\": \"CHANGED\", \"confidentialityImpact\": \"LOW\", \"integrityImpact\": \"LOW\", \"availabilityImpact\": \"NONE\"}, \"exploitabilityScore\": 3.9, \"impactScore\": 2.7}]}",
"published": "2024-08-16T02:15:16.600",
"references": "[{\"url\": \"https://developers.ibexa.co/security-advisories/ibexa-sa-2024-005-persistent-xss-in-richtext\", \"source\": \"security-advisories@github.com\"}, {\"url\": \"https://github.com/ezsystems/ezplatform-richtext/security/advisories/GHSA-rhm7-7469-rcpw\", \"source\": \"security-advisories@github.com\"}, {\"url\": \"https://github.com/ibexa/fieldtype-richtext/commit/0a3b830e8806d5169f697351fdc48ffd95a25c67\", \"source\": \"security-advisories@github.com\"}, {\"url\": \"https://github.com/ibexa/fieldtype-richtext/commit/59e9c1a9da60597f60cf7338bf289dccaa7e27ca\", \"source\": \"security-advisories@github.com\"}, {\"url\": \"https://github.com/ibexa/fieldtype-richtext/security/advisories/GHSA-hvcf-6324-cjh7\", \"source\": \"security-advisories@github.com\"}]",
"sourceIdentifier": "security-advisories@github.com",
"vulnStatus": "Awaiting Analysis",
"weaknesses": "[{\"source\": \"security-advisories@github.com\", \"type\": \"Secondary\", \"description\": [{\"lang\": \"en\", \"value\": \"CWE-79\"}]}]"
},
"nvd": "{\"cve\":{\"id\":\"CVE-2024-43369\",\"sourceIdentifier\":\"security-advisories@github.com\",\"published\":\"2024-08-16T02:15:16.600\",\"lastModified\":\"2024-08-19T13:00:23.117\",\"vulnStatus\":\"Awaiting Analysis\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"Ibexa RichText Field Type is a Field Type for supporting rich formatted text stored in a structured XML format. In versions on the 4.6 branch prior to 4.6.10, the validator for the RichText fieldtype blocklists `javascript:` and `vbscript:` in links to prevent XSS. This can leave other options open, and the check can be circumvented using upper case. Content editing permissions for RichText content is required to exploit this vulnerability, which typically means Editor role or higher. The fix implements an allowlist instead, which allows only approved link protocols. The new check is case insensitive. Version 4.6.10 contains a patch for this issue. No known workarounds are available.\"},{\"lang\":\"es\",\"value\":\" Ibexa RichText Field Type es un tipo de campo que admite texto enriquecido almacenado en un formato XML estructurado. En las versiones de la rama 4.6 anteriores a la 4.6.10, el validador para el tipo de campo RichText incluye listas de bloqueo `javascript:` y `vbscript:` en enlaces para evitar XSS. Esto puede dejar otras opciones abiertas y la verificaci\u00f3n se puede omitir usando may\u00fasculas. Se requieren permisos de edici\u00f3n de contenido para contenido RichText para aprovechar esta vulnerabilidad, lo que normalmente significa la funci\u00f3n de Editor o superior. En su lugar, la soluci\u00f3n implementa una lista de permitidos, que solo permite protocolos de enlace aprobados. El nuevo cheque no distingue entre may\u00fasculas y min\u00fasculas. La versi\u00f3n 4.6.10 contiene un parche para este problema. No hay soluciones conocidas disponibles.\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N\",\"baseScore\":7.2,\"baseSeverity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"CHANGED\",\"confidentialityImpact\":\"LOW\",\"integrityImpact\":\"LOW\",\"availabilityImpact\":\"NONE\"},\"exploitabilityScore\":3.9,\"impactScore\":2.7}]},\"weaknesses\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-79\"}]}],\"references\":[{\"url\":\"https://developers.ibexa.co/security-advisories/ibexa-sa-2024-005-persistent-xss-in-richtext\",\"source\":\"security-advisories@github.com\"},{\"url\":\"https://github.com/ezsystems/ezplatform-richtext/security/advisories/GHSA-rhm7-7469-rcpw\",\"source\":\"security-advisories@github.com\"},{\"url\":\"https://github.com/ibexa/fieldtype-richtext/commit/0a3b830e8806d5169f697351fdc48ffd95a25c67\",\"source\":\"security-advisories@github.com\"},{\"url\":\"https://github.com/ibexa/fieldtype-richtext/commit/59e9c1a9da60597f60cf7338bf289dccaa7e27ca\",\"source\":\"security-advisories@github.com\"},{\"url\":\"https://github.com/ibexa/fieldtype-richtext/security/advisories/GHSA-hvcf-6324-cjh7\",\"source\":\"security-advisories@github.com\"}]}}",
"vulnrichment": {
"containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2024-43369\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"yes\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-08-16T13:57:12.758236Z\"}}}], \"affected\": [{\"cpes\": [\"cpe:2.3:a:ibexa:fieldtype-richtext:*:*:*:*:*:*:*:*\"], \"vendor\": \"ibexa\", \"product\": \"fieldtype-richtext\", \"versions\": [{\"status\": \"affected\", \"version\": \"4.6\", \"lessThan\": \"4.6.10\", \"versionType\": \"custom\"}], \"defaultStatus\": \"unknown\"}, {\"cpes\": [\"cpe:2.3:a:ibexa:ezplatform-richtext:*:*:*:*:*:*:*:*\"], \"vendor\": \"ibexa\", \"product\": \"ezplatform-richtext\", \"versions\": [{\"status\": \"affected\", \"version\": \"3.3\", \"lessThan\": \"3.3.40\", \"versionType\": \"custom\"}], \"defaultStatus\": \"unknown\"}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-08-16T14:05:29.069Z\"}}], \"cna\": {\"title\": \"Persistent Cross-site Scripting in Ibexa RichText Field Type\", \"source\": {\"advisory\": \"GHSA-hvcf-6324-cjh7\", \"discovery\": \"UNKNOWN\"}, \"metrics\": [{\"cvssV3_1\": {\"scope\": \"CHANGED\", \"version\": \"3.1\", \"baseScore\": 7.2, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N\", \"integrityImpact\": \"LOW\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"NONE\", \"privilegesRequired\": \"NONE\", \"confidentialityImpact\": \"LOW\"}}], \"affected\": [{\"vendor\": \"ibexa\", \"product\": \"fieldtype-richtext\", \"versions\": [{\"status\": \"affected\", \"version\": \"\u003e= 4.6.0, \u003c 4.6.10\"}]}], \"references\": [{\"url\": \"https://github.com/ibexa/fieldtype-richtext/security/advisories/GHSA-hvcf-6324-cjh7\", \"name\": \"https://github.com/ibexa/fieldtype-richtext/security/advisories/GHSA-hvcf-6324-cjh7\", \"tags\": [\"x_refsource_CONFIRM\"]}, {\"url\": \"https://github.com/ezsystems/ezplatform-richtext/security/advisories/GHSA-rhm7-7469-rcpw\", \"name\": \"https://github.com/ezsystems/ezplatform-richtext/security/advisories/GHSA-rhm7-7469-rcpw\", \"tags\": [\"x_refsource_MISC\"]}, {\"url\": \"https://github.com/ibexa/fieldtype-richtext/commit/0a3b830e8806d5169f697351fdc48ffd95a25c67\", \"name\": \"https://github.com/ibexa/fieldtype-richtext/commit/0a3b830e8806d5169f697351fdc48ffd95a25c67\", \"tags\": [\"x_refsource_MISC\"]}, {\"url\": \"https://github.com/ibexa/fieldtype-richtext/commit/59e9c1a9da60597f60cf7338bf289dccaa7e27ca\", \"name\": \"https://github.com/ibexa/fieldtype-richtext/commit/59e9c1a9da60597f60cf7338bf289dccaa7e27ca\", \"tags\": [\"x_refsource_MISC\"]}, {\"url\": \"https://developers.ibexa.co/security-advisories/ibexa-sa-2024-005-persistent-xss-in-richtext\", \"name\": \"https://developers.ibexa.co/security-advisories/ibexa-sa-2024-005-persistent-xss-in-richtext\", \"tags\": [\"x_refsource_MISC\"]}], \"descriptions\": [{\"lang\": \"en\", \"value\": \"Ibexa RichText Field Type is a Field Type for supporting rich formatted text stored in a structured XML format. In versions on the 4.6 branch prior to 4.6.10, the validator for the RichText fieldtype blocklists `javascript:` and `vbscript:` in links to prevent XSS. This can leave other options open, and the check can be circumvented using upper case. Content editing permissions for RichText content is required to exploit this vulnerability, which typically means Editor role or higher. The fix implements an allowlist instead, which allows only approved link protocols. The new check is case insensitive. Version 4.6.10 contains a patch for this issue. No known workarounds are available.\"}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-79\", \"description\": \"CWE-79: Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)\"}]}], \"providerMetadata\": {\"orgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"shortName\": \"GitHub_M\", \"dateUpdated\": \"2024-08-15T23:17:19.044Z\"}}}",
"cveMetadata": "{\"cveId\": \"CVE-2024-43369\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2024-08-16T14:05:43.757Z\", \"dateReserved\": \"2024-08-09T14:23:55.513Z\", \"assignerOrgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"datePublished\": \"2024-08-15T23:17:19.044Z\", \"assignerShortName\": \"GitHub_M\"}",
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
}
}
Loading…
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
Loading…