{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2024-50348", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2024-10-22T17:54:40.957Z", "datePublished": "2024-10-29T22:25:19.138Z", "dateUpdated": "2024-10-30T13:13:20.085Z"}, "containers": {"cna": {"title": "InstantCMS has a Cross Site Scripting Vulnerability", "problemTypes": [{"descriptions": [{"cweId": "CWE-79", "lang": "en", "description": "CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N", "version": "3.1"}}], "references": [{"name": "https://github.com/instantsoft/icms2/security/advisories/GHSA-f6cf-jg84-fw29", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/instantsoft/icms2/security/advisories/GHSA-f6cf-jg84-fw29"}, {"name": "https://github.com/instantsoft/icms2/commit/e02de2fa1850bb40c9b2050b9256c838a0ea7aa3", "tags": ["x_refsource_MISC"], "url": "https://github.com/instantsoft/icms2/commit/e02de2fa1850bb40c9b2050b9256c838a0ea7aa3"}], "affected": [{"vendor": "instantsoft", "product": "icms2", "versions": [{"version": "< 2.16.3", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2024-10-29T22:25:19.138Z"}, "descriptions": [{"lang": "en", "value": "InstantCMS is a free and open source content management system. In photo upload function in the photo album page there is no input validation taking place. Due to this attackers are able to inject the XSS (Cross Site Scripting) payload and execute. This vulnerability is fixed in 2.16.3."}], "source": {"advisory": "GHSA-f6cf-jg84-fw29", "discovery": "UNKNOWN"}}, "adp": [{"affected": [{"vendor": "instantcms", "product": "icms2", "cpes": ["cpe:2.3:a:instantcms:icms2:*:*:*:*:*:*:*:*"], "defaultStatus": "unknown", "versions": [{"version": "0", "status": "affected", "lessThan": "2.16.3", "versionType": "custom"}]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2024-10-30T13:11:41.901398Z", "id": "CVE-2024-50348", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-10-30T13:13:20.085Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"cna": {"title": "InstantCMS has a Cross Site Scripting Vulnerability", "source": {"advisory": "GHSA-f6cf-jg84-fw29", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 5.4, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}}], "affected": [{"vendor": "instantsoft", "product": "icms2", "versions": [{"status": "affected", "version": "< 2.16.3"}]}], "references": [{"url": "https://github.com/instantsoft/icms2/security/advisories/GHSA-f6cf-jg84-fw29", "name": "https://github.com/instantsoft/icms2/security/advisories/GHSA-f6cf-jg84-fw29", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/instantsoft/icms2/commit/e02de2fa1850bb40c9b2050b9256c838a0ea7aa3", "name": "https://github.com/instantsoft/icms2/commit/e02de2fa1850bb40c9b2050b9256c838a0ea7aa3", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "InstantCMS is a free and open source content management system. In photo upload function in the photo album page there is no input validation taking place. Due to this attackers are able to inject the XSS (Cross Site Scripting) payload and execute. This vulnerability is fixed in 2.16.3."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-79", "description": "CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2024-10-29T22:25:19.138Z"}}, "adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-50348", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-10-30T13:11:41.901398Z"}}}], "affected": [{"cpes": ["cpe:2.3:a:instantcms:icms2:*:*:*:*:*:*:*:*"], "vendor": "instantcms", "product": "icms2", "versions": [{"status": "affected", "version": "0", "lessThan": "2.16.3", "versionType": "custom"}], "defaultStatus": "unknown"}], "providerMetadata": {"shortName": "CISA-ADP", "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "dateUpdated": "2024-10-30T13:13:13.555Z"}}]}, "cveMetadata": {"cveId": "CVE-2024-50348", "state": "PUBLISHED", "dateUpdated": "2024-10-29T22:25:19.138Z", "dateReserved": "2024-10-22T17:54:40.957Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2024-10-29T22:25:19.138Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:instantcms:instantcms:*:*:*:*:*:*:*:*", "matchCriteriaId": "D502D2E1-810F-4B47-97EA-779586CB2B78", "versionEndExcluding": "2.16.3", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "InstantCMS is a free and open source content management system. In photo upload function in the photo album page there is no input validation taking place. Due to this attackers are able to inject the XSS (Cross Site Scripting) payload and execute. This vulnerability is fixed in 2.16.3."}, {"lang": "es", "value": "InstantCMS es un sistema de gesti\u00f3n de contenido gratuito y de c\u00f3digo abierto. En la funci\u00f3n de carga de fotos de la p\u00e1gina del \u00e1lbum de fotos no se realiza ninguna validaci\u00f3n de entrada. Debido a esto, los atacantes pueden inyectar el payload XSS (Cross Site Scripting) y ejecutarlo. Esta vulnerabilidad se corrigi\u00f3 en la versi\u00f3n 2.16.3."}], "id": "CVE-2024-50348", "lastModified": "2024-11-06T14:49:46.073", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.3, "impactScore": 2.7, "source": "nvd@nist.gov", "type": "Primary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.3, "impactScore": 2.7, "source": "security-advisories@github.com", "type": "Secondary"}]}, "published": "2024-10-29T23:15:03.863", "references": [{"source": "security-advisories@github.com", "tags": ["Patch"], "url": "https://github.com/instantsoft/icms2/commit/e02de2fa1850bb40c9b2050b9256c838a0ea7aa3"}, {"source": "security-advisories@github.com", "tags": ["Exploit", "Patch", "Vendor Advisory"], "url": "https://github.com/instantsoft/icms2/security/advisories/GHSA-f6cf-jg84-fw29"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "security-advisories@github.com", "type": "Primary"}]}

{}