CVE-2024-53864

Vulnerability

Overview

The Content name pattern in Ibexa Admin UI Bundle is used to dynamically build Content names from one or more fields. CVE-2024-53864 describes a stored Cross-Site Scripting (XSS) vulnerability within this mechanism. An attacker who possesses content edit permissions can inject malicious JavaScript into a field that is part of the name pattern. When the content is subsequently rendered (e.g., in the Back Office interface), the injected script executes in the context of the victim's session, potentially leading to data theft or further compromise [3][4].

Exploitation

Requirements

To exploit the vulnerability, an attacker must have content edit privileges in the Ibexa DXP system. No additional network position or authentication bypass is required; the attack is performed through normal content editing workflows. The injected payload is stored in the database and triggers whenever the affected content's name is displayed, such as in list views, breadcrumbs, or other areas that render the Content name pattern [3][4].

Impact

Successful exploitation enables arbitrary JavaScript execution within the browser of any user viewing the manipulated content name. This can lead to session hijacking, forced actions on behalf of the victim, or exposure of sensitive information displayed in the same administrative interface. The severity is rated Medium (CVSS score not explicitly given, but described as high in advisory [4]) because exploitation requires prior authentication with content edit permissions, limiting the attack surface to trusted users or those who have already compromised an editor account.

Mitigation

The vulnerability is patched in version 4.6.14 of the Ibexa Admin UI Bundle. Users running Ibexa DXP v4.6.* should upgrade to this version immediately. Ibexa DXP v3.3.* is not affected by this specific issue [4]. No workarounds are available; the fix ensures that any previously injected XSS payloads will no longer execute [1][3]. As part of a broader security release (Ibexa SA-2024-006), other critical fixes were also included, making the upgrade strongly recommended [4].