CVE-2024-5737 - Vulnerability Details - OpenCVE

Script afGdStream.php in AdmirorFrames Joomla! extension doesn’t specify a content type and as a result default (text/html) is used. An attacker may embed HTML tags directly in image data which is rendered by a webpage as HTML. This issue affects AdmirorFrames: before 5.0.

Attack Vector Network

Attack Complexity High

Privileges Required None

Attack Requirements None

User Interaction None

Vulnerable System Confidentiality Impact None

Vulnerable System Integrity Impact Low

Vulnerable System Availability Impact Low

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Changed

Confidentiality Impact Low

Integrity Impact Low

Availability Impact None

User Interaction Required

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

Vendors	Products
Admiror-design-studio	Admirorframes

Configuration 1 [-]

cpe:2.3:a:admiror-design-studio:admirorframes:*:*:*:*:*:joomla\!:*:*

No data.

References

Link	Providers
https://cert.pl/en/posts/2024/06/CVE-2024-5735/
https://cert.pl/posts/2024/06/CVE-2024-5735/
https://github.com/afine-com/CVE-2024-5737
https://github.com/sectroyer/CVEs/tree/main/CVE-2024-5737
https://github.com/vasiljevski/admirorframes/issues/3

History

No history.

MITRE

Status: PUBLISHED

Assigner: CERT-PL

Published: 2024-06-28T11:29:03.154Z

Updated: 2024-08-01T21:18:07.021Z

Reserved: 2024-06-07T06:09:43.874Z

Link: CVE-2024-5737

Vulnrichment

Updated: 2024-08-01T21:18:07.021Z

NVD

Status : Modified

Published: 2024-06-28T12:15:11.060

Modified: 2024-11-21T09:48:15.713

Link: CVE-2024-5737

Redhat

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2024-5737", "assignerOrgId": "4bb8329e-dd38-46c1-aafb-9bf32bcb93c6", "state": "PUBLISHED", "assignerShortName": "CERT-PL", "dateReserved": "2024-06-07T06:09:43.874Z", "datePublished": "2024-06-28T11:29:03.154Z", "dateUpdated": "2024-08-01T21:18:07.021Z"}, "containers": {"cna": {"affected": [{"collectionURL": "https://www.admiror-design-studio.com/admiror-joomla-extensions/admiror-frames", "defaultStatus": "unaffected", "platforms": ["Joomla!"], "product": "AdmirorFrames", "repo": "https://github.com/vasiljevski/admirorframes", "vendor": "Nikola Vasilijevski", "versions": [{"lessThan": "5.0", "status": "affected", "version": "0", "versionType": "custom"}]}], "credits": [{"lang": "en", "type": "finder", "value": "Marcin Wyczechowski [AFINE Team]"}, {"lang": "en", "type": "finder", "value": "Micha\u0142 Majchrowicz [AFINE Team]"}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "Script afGdStream.php in AdmirorFrames Joomla! extension doesn\u2019t specify a content type and as a result default (text/html) is used. An attacker may embed HTML tags directly in image data which is rendered by a webpage as HTML. <p>This issue affects AdmirorFrames: before 5.0.</p>"}], "value": "Script afGdStream.php in\u00a0AdmirorFrames Joomla! extension doesn\u2019t specify a content type and as a result default (text/html) is used. An attacker may embed HTML tags directly in image data which is rendered by a webpage as HTML.\u00a0This issue affects AdmirorFrames: before 5.0."}], "impacts": [{"capecId": "CAPEC-63", "descriptions": [{"lang": "en", "value": "CAPEC-63 Cross-Site Scripting (XSS)"}]}], "metrics": [{"cvssV4_0": {"Automatable": "YES", "Recovery": "USER", "Safety": "NOT_DEFINED", "attackComplexity": "HIGH", "attackRequirements": "NONE", "attackVector": "NETWORK", "baseScore": 6.3, "baseSeverity": "MEDIUM", "privilegesRequired": "NONE", "providerUrgency": "GREEN", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "DIFFUSE", "vectorString": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/AU:Y/R:U/V:D/RE:L/U:Green", "version": "4.0", "vulnAvailabilityImpact": "LOW", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "LOW", "vulnerabilityResponseEffort": "LOW"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-79", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "4bb8329e-dd38-46c1-aafb-9bf32bcb93c6", "shortName": "CERT-PL", "dateUpdated": "2024-06-28T11:31:21.794Z"}, "references": [{"tags": ["third-party-advisory"], "url": "https://cert.pl/en/posts/2024/06/CVE-2024-5735/"}, {"tags": ["third-party-advisory"], "url": "https://cert.pl/posts/2024/06/CVE-2024-5735/"}, {"tags": ["issue-tracking"], "url": "https://github.com/vasiljevski/admirorframes/issues/3"}, {"tags": ["technical-description"], "url": "https://github.com/sectroyer/CVEs/tree/main/CVE-2024-5737"}, {"tags": ["technical-description"], "url": "https://github.com/afine-com/CVE-2024-5737"}], "source": {"discovery": "UNKNOWN"}, "title": "HTML Injection in AdmirorFrames Joomla! Extension", "x_generator": {"engine": "Vulnogram 0.2.0"}}, "adp": [{"affected": [{"vendor": "admiror-design-studio", "product": "admiror_frames", "cpes": ["cpe:2.3:a:admiror-design-studio:admiror_frames:5.0:*:*:*:*:*:*:*"], "defaultStatus": "unknown", "versions": [{"version": "0", "status": "affected", "lessThan": "5.0", "versionType": "custom"}]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2024-07-02T21:59:53.619986Z", "id": "CVE-2024-5737", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-07-02T22:01:41.843Z"}}, {"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-01T21:18:07.021Z"}, "title": "CVE Program Container", "references": [{"tags": ["third-party-advisory", "x_transferred"], "url": "https://cert.pl/en/posts/2024/06/CVE-2024-5735/"}, {"tags": ["third-party-advisory", "x_transferred"], "url": "https://cert.pl/posts/2024/06/CVE-2024-5735/"}, {"tags": ["issue-tracking", "x_transferred"], "url": "https://github.com/vasiljevski/admirorframes/issues/3"}, {"tags": ["technical-description", "x_transferred"], "url": "https://github.com/sectroyer/CVEs/tree/main/CVE-2024-5737"}, {"tags": ["technical-description", "x_transferred"], "url": "https://github.com/afine-com/CVE-2024-5737"}]}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://cert.pl/en/posts/2024/06/CVE-2024-5735/", "tags": ["third-party-advisory", "x_transferred"]}, {"url": "https://cert.pl/posts/2024/06/CVE-2024-5735/", "tags": ["third-party-advisory", "x_transferred"]}, {"url": "https://github.com/vasiljevski/admirorframes/issues/3", "tags": ["issue-tracking", "x_transferred"]}, {"url": "https://github.com/sectroyer/CVEs/tree/main/CVE-2024-5737", "tags": ["technical-description", "x_transferred"]}, {"url": "https://github.com/afine-com/CVE-2024-5737", "tags": ["technical-description", "x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-01T21:18:07.021Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-5737", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-07-02T21:59:53.619986Z"}}}], "affected": [{"cpes": ["cpe:2.3:a:admiror-design-studio:admiror_frames:5.0:*:*:*:*:*:*:*"], "vendor": "admiror-design-studio", "product": "admiror_frames", "versions": [{"status": "affected", "version": "0", "lessThan": "5.0", "versionType": "custom"}], "defaultStatus": "unknown"}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-07-02T22:01:37.709Z"}}], "cna": {"title": "HTML Injection in AdmirorFrames Joomla! Extension", "source": {"discovery": "UNKNOWN"}, "credits": [{"lang": "en", "type": "finder", "value": "Marcin Wyczechowski [AFINE Team]"}, {"lang": "en", "type": "finder", "value": "Micha\u0142 Majchrowicz [AFINE Team]"}], "impacts": [{"capecId": "CAPEC-63", "descriptions": [{"lang": "en", "value": "CAPEC-63 Cross-Site Scripting (XSS)"}]}], "metrics": [{"format": "CVSS", "cvssV4_0": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "USER", "baseScore": 6.3, "Automatable": "YES", "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "valueDensity": "DIFFUSE", "vectorString": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/AU:Y/R:U/V:D/RE:L/U:Green", "providerUrgency": "GREEN", "userInteraction": "NONE", "attackComplexity": "HIGH", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "LOW", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "LOW", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "vulnerabilityResponseEffort": "LOW"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"repo": "https://github.com/vasiljevski/admirorframes", "vendor": "Nikola Vasilijevski", "product": "AdmirorFrames", "versions": [{"status": "affected", "version": "0", "lessThan": "5.0", "versionType": "custom"}], "platforms": ["Joomla!"], "collectionURL": "https://www.admiror-design-studio.com/admiror-joomla-extensions/admiror-frames", "defaultStatus": "unaffected"}], "references": [{"url": "https://cert.pl/en/posts/2024/06/CVE-2024-5735/", "tags": ["third-party-advisory"]}, {"url": "https://cert.pl/posts/2024/06/CVE-2024-5735/", "tags": ["third-party-advisory"]}, {"url": "https://github.com/vasiljevski/admirorframes/issues/3", "tags": ["issue-tracking"]}, {"url": "https://github.com/sectroyer/CVEs/tree/main/CVE-2024-5737", "tags": ["technical-description"]}, {"url": "https://github.com/afine-com/CVE-2024-5737", "tags": ["technical-description"]}], "x_generator": {"engine": "Vulnogram 0.2.0"}, "descriptions": [{"lang": "en", "value": "Script afGdStream.php in\u00a0AdmirorFrames Joomla! extension doesn\u2019t specify a content type and as a result default (text/html) is used. An attacker may embed HTML tags directly in image data which is rendered by a webpage as HTML.\u00a0This issue affects AdmirorFrames: before 5.0.", "supportingMedia": [{"type": "text/html", "value": "Script afGdStream.php in AdmirorFrames Joomla! extension doesn\u2019t specify a content type and as a result default (text/html) is used. An attacker may embed HTML tags directly in image data which is rendered by a webpage as HTML. <p>This issue affects AdmirorFrames: before 5.0.</p>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-79", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')"}]}], "providerMetadata": {"orgId": "4bb8329e-dd38-46c1-aafb-9bf32bcb93c6", "shortName": "CERT-PL", "dateUpdated": "2024-06-28T11:31:21.794Z"}}}, "cveMetadata": {"cveId": "CVE-2024-5737", "state": "PUBLISHED", "dateUpdated": "2024-08-01T21:18:07.021Z", "dateReserved": "2024-06-07T06:09:43.874Z", "assignerOrgId": "4bb8329e-dd38-46c1-aafb-9bf32bcb93c6", "datePublished": "2024-06-28T11:29:03.154Z", "assignerShortName": "CERT-PL"}, "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:admiror-design-studio:admirorframes:*:*:*:*:*:joomla\\!:*:*", "matchCriteriaId": "C5EF0F23-1AE6-4174-96B5-D0ADAC6163BC", "versionEndExcluding": "5.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "descriptions": [{"lang": "en", "value": "Script afGdStream.php in\u00a0AdmirorFrames Joomla! extension doesn\u2019t specify a content type and as a result default (text/html) is used. An attacker may embed HTML tags directly in image data which is rendered by a webpage as HTML.\u00a0This issue affects AdmirorFrames: before 5.0."}, {"lang": "es", "value": "Script afGdStream.php en AdmirorFrames Joomla! La extensi\u00f3n no especifica un tipo de contenido y, como resultado, se utiliza el valor predeterminado (texto/html). Un atacante puede incrustar etiquetas HTML directamente en datos de im\u00e1genes que una p\u00e1gina web representa como HTML. Este problema afecta a AdmirorFrames: anteriores a 5.0."}], "id": "CVE-2024-5737", "lastModified": "2024-11-21T09:48:15.713", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.1, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 2.7, "source": "nvd@nist.gov", "type": "Primary"}], "cvssMetricV40": [{"cvssData": {"attackComplexity": "HIGH", "attackRequirements": "NONE", "attackVector": "NETWORK", "automatable": "YES", "availabilityRequirements": "NOT_DEFINED", "baseScore": 6.3, "baseSeverity": "MEDIUM", "confidentialityRequirements": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirements": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubsequentSystemAvailability": "NOT_DEFINED", "modifiedSubsequentSystemConfidentiality": "NOT_DEFINED", "modifiedSubsequentSystemIntegrity": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnerableSystemAvailability": "NOT_DEFINED", "modifiedVulnerableSystemConfidentiality": "NOT_DEFINED", "modifiedVulnerableSystemIntegrity": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "GREEN", "recovery": "USER", "safety": "NOT_DEFINED", "subsequentSystemAvailability": "NONE", "subsequentSystemConfidentiality": "NONE", "subsequentSystemIntegrity": "NONE", "userInteraction": "NONE", "valueDensity": "DIFFUSE", "vectorString": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:U/V:D/RE:L/U:Green", "version": "4.0", "vulnerabilityResponseEffort": "LOW", "vulnerableSystemAvailability": "LOW", "vulnerableSystemConfidentiality": "NONE", "vulnerableSystemIntegrity": "LOW"}, "source": "cvd@cert.pl", "type": "Secondary"}]}, "published": "2024-06-28T12:15:11.060", "references": [{"source": "cvd@cert.pl", "tags": ["Third Party Advisory"], "url": "https://cert.pl/en/posts/2024/06/CVE-2024-5735/"}, {"source": "cvd@cert.pl", "tags": ["Third Party Advisory"], "url": "https://cert.pl/posts/2024/06/CVE-2024-5735/"}, {"source": "cvd@cert.pl", "tags": ["Exploit", "Third Party Advisory"], "url": "https://github.com/afine-com/CVE-2024-5737"}, {"source": "cvd@cert.pl", "tags": ["Exploit", "Third Party Advisory"], "url": "https://github.com/sectroyer/CVEs/tree/main/CVE-2024-5737"}, {"source": "cvd@cert.pl", "tags": ["Issue Tracking"], "url": "https://github.com/vasiljevski/admirorframes/issues/3"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Third Party Advisory"], "url": "https://cert.pl/en/posts/2024/06/CVE-2024-5735/"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Third Party Advisory"], "url": "https://cert.pl/posts/2024/06/CVE-2024-5735/"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Exploit", "Third Party Advisory"], "url": "https://github.com/afine-com/CVE-2024-5737"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Exploit", "Third Party Advisory"], "url": "https://github.com/sectroyer/CVEs/tree/main/CVE-2024-5737"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Issue Tracking"], "url": "https://github.com/vasiljevski/admirorframes/issues/3"}], "sourceIdentifier": "cvd@cert.pl", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "cvd@cert.pl", "type": "Secondary"}, {"description": [{"lang": "en", "value": "CWE-79"}], "source": "nvd@nist.gov", "type": "Primary"}]}