Skip to content
OpenAdvisories
Medium · 4.7 CVE-2024-26481 EUVD-2024-0519GHSA-57f2-8p89-66x6

Kirby vulnerable to self cross-site scripting (self-XSS) in the URL field

Published Feb 22, 2024 · Updated Aug 14, 2024 · Assigned by mitre

Package: getkirby/cms Ecosystem: Packagist

Description

Kirby CMS v4.1.0 was discovered to contain a reflected self-XSS vulnerability via the URL parameter.

Affected packages

EcosystemPackageAffectedFixedRecord
Packagist getkirby/cms < 3.6.6.5 3.6.6.5 GHSA-57f2-8p89-66x6
Packagist getkirby/cms >= 3.7.0, < 3.7.5.4 3.7.5.4 GHSA-57f2-8p89-66x6
Packagist getkirby/cms >= 3.8.0, < 3.8.4.3 3.8.4.3 GHSA-57f2-8p89-66x6
Packagist getkirby/cms >= 3.9.0, < 3.9.8.1 3.9.8.1 GHSA-57f2-8p89-66x6
Packagist getkirby/cms >= 3.10.0, < 3.10.0.1 3.10.0.1 GHSA-57f2-8p89-66x6
Packagist getkirby/cms >= 4.0.0, < 4.1.1 4.1.1 GHSA-57f2-8p89-66x6

References