CVE-2024-46209

Vulnerability

Overview

A stored cross-site scripting (XSS) vulnerability exists in REDAXO CMS version 5.17.1 within the /media/test.html component. The flaw allows an attacker to inject arbitrary web scripts or HTML by crafting a malicious payload in the password parameter [1].

Attack

Vector

An attacker can exploit this by submitting a crafted payload through the password field. Since the vulnerability is stored, the malicious script persists in the application and executes when other users view the affected page. No authentication or special network position is required for the initial injection, though the attacker must have access to the form [1].

Impact

Successful exploitation enables arbitrary HTML or script execution in the context of a victim's browser. This can lead to session hijacking, defacement, or theft of sensitive information displayed on the page [1].

Mitigation

As of the publication date, no official patch or workaround has been announced by REDAXO. Users should consider restricting access to the /media/test.html endpoint and upgrading when a fix is released [1].