CVE-2024-58297
MediumCVSS 5.4Exploitation Probability (EPSS)
Low risk17th percentile - higher than 17% of all known CVEs
Summary
PyroCMS v3.0.1 contains a stored cross-site scripting vulnerability in the admin redirects configuration that allows attackers to inject malicious scripts. A payload in the 'Redirect From' field executes arbitrary JavaScript when administrators view the redirects page.
Risk Assessment
An attacker may execute arbitrary JavaScript in the administrator's browser, potentially leading to session theft and administrative account compromise.
Recommendation
Update PyroCMS to a patched version and implement input encoding in redirect configuration fields.
Other vulnerabilities in PyroCMS
See all- CVE-2022-37721Critical
PyroCMS 3.9 is vulnerable to a stored XSS attack, allowing a low-privileged user (e.g., author) to inject malicious HTML and JavaScript into blog post content. This can lead to full admin account takeover or privilege escalation.
- CVE-2022-35118Medium
PyroCMS version 3.9 was found to contain multiple cross-site scripting (XSS) vulnerabilities.
Original NVD description (English source)
PyroCMS v3.0.1 contains a stored cross-site scripting vulnerability in the admin redirects configuration that allows attackers to inject malicious scripts. Attackers can insert a payload in the 'Redirect From' field to execute arbitrary JavaScript when administrators view the redirects page.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS