High severity · published Jan 3, 2024
CVE-2024-21622
Craft is a content management system
8.8
CVSS
0.6%
EPSS
No
On KEV
Description
Craft is a content management system. This is a potential moderate impact, low complexity privilege escalation vulnerability in Craft starting in 3.x prior to 3.9.6 and 4.x prior to 4.4.16 with certain user permissions setups. This has been fixed in Craft 4.4.16 and Craft 3.9.6. Users should ensure they are running at least those versions.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.6% · higher than 48% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CC
Craft Cms · Craftcms
3.0.0 before 3.9.6; 4.0.0 through 4.5.15 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-21622
CVE.org
https://www.cve.org/CVERecord?id=CVE-2024-21622
Release Notes
https://github.com/craftcms/cms/blob/develop/CHANGELOG.md#4511---2023-11-16
Release Notes
https://github.com/craftcms/cms/blob/v3/CHANGELOG.md#396---2023-11-16
Patch
https://github.com/craftcms/cms/commit/76caf9af07d9964be0fd362772223be6a5f5b6aa
Patch
https://github.com/craftcms/cms/commit/be81eb653d633833f2ab22510794abb6bb9c0843
Issue Tracking
https://github.com/craftcms/cms/pull/13931
Issue Tracking
https://github.com/craftcms/cms/pull/13932
More from Craft Cms
10.0
CVE-2025-32432
Craft CMS Allows Remote Code Execution
9.8
CVE-2024-56145
RCE when PHP `register_argc_argv` config setting is enabled in craftcms/cms
8.1
CVE-2025-23209
Potential RCE with a compromised security key in craft/cms
5.3
CVE-2025-35939
Craft CMS stores user-provided content in session files
9.8
CVE-2026-32267
Craft CMS Vulnerable to Privilege Escalation/Bypass through UsersController->actionImpersonateWithToken()