GHSA-j5g9-j7r4-6qvx

Craft CMS Privilege Escalation

Source: GitHub Advisory Database (reviewed) Moderate CVE-2024-21622

Packages

Ecosystem	Package	Affected	Fixed in
Packagist	craftcms/cms	>= 4.0.0-RC1, < 4.5.11	4.5.11
Packagist	craftcms/cms	>= 3.0.0, < 3.9.6	3.9.6

Details

As written in the advisory (Markdown source, shown as plain text).

### Impact This is a potential moderate impact, low complexity privilege escalation vulnerability in Craft with certain user permissions setups. ### Patches This has been fixed in Craft 4.4.16 and Craft 3.9.6. Users should ensure they are running at least those versions. ### References https://github.com/craftcms/cms/pull/13932 https://github.com/craftcms/cms/pull/13931 https://github.com/craftcms/cms/blob/develop/CHANGELOG.md#4511---2023-11-16 https://github.com/craftcms/cms/blob/v3/CHANGELOG.md#396---2023-11-16

References

External links from the advisory. They lead to third-party sites.

https://github.com/craftcms/cms/security/advisories/GHSA-j5g9-j7r4-6qvx web
https://nvd.nist.gov/vuln/detail/CVE-2024-21622 advisory
https://github.com/craftcms/cms/pull/13931 web
https://github.com/craftcms/cms/pull/13932 web
https://github.com/craftcms/cms/commit/76caf9af07d9964be0fd362772223be6a5f5b6aa web
https://github.com/craftcms/cms/commit/be81eb653d633833f2ab22510794abb6bb9c0843 web
https://github.com/craftcms/cms package
https://github.com/craftcms/cms/blob/develop/CHANGELOG.md#4511---2023-11-16 web
https://github.com/craftcms/cms/blob/v3/CHANGELOG.md#396---2023-11-16 web