Medium severity · published Jan 9, 2025
CVE-2024-13209
Redaxo CMS Structure Management Page index.php cross site scripting
5.4
CVSS
0.4%
EPSS
No
On KEV
Description
A vulnerability was found in Redaxo CMS 5.18.1. It has been classified as problematic. Affected is an unknown function of the file /index.php?page=structure&category_id=1&article_id=1&clang=1&function=edit_art&artstart=0 of the component Structure Management Page. The manipulation of the argument Article Name leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
Required
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 34% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CM
CMS · Redaxo
5.18.1 · source: vendor
RE
Redaxo · Redaxo
5.18.1 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-13209
CVE.org
https://www.cve.org/CVERecord?id=CVE-2024-13209
Exploit
https://geochen.medium.com/redaxo-cms-5-18-1-cross-site-scripting-7c9a872c72f6
Permissions Required
https://vuldb.com/?ctiid.290814
Third Party Advisory
https://vuldb.com/?id.290814
Third Party Advisory
https://vuldb.com/?submit.466396
