CVE-2024-13209 json
Redaxo CMS Structure Management Page index.php cross site scripting
published 2025-01-09 21 mo ago modified 2026-06-17 4 mo ago also GHSA-7wj8-856p-qc9m , EUVD-2024-51430
- cvss
- 2.4
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.4%
- EPSS 0.4% chance of exploitation in 30 days, percentile 34%
- public exploits
- 0
- none known
Summary
A vulnerability was found in Redaxo CMS 5.18.1. It has been classified as problematic. Affected is an unknown function of the file /index.php?page=structure&category_id=1&article_id=1&clang=1&function=edit_art&artstart=0 of the component Structure Management Page. The manipulation of the argument Article Name leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Patch / fix
CISA SSVC
- Exploitation
- Proof of concept is public
- Automatable
- no
- Technical impact
- partial
- Assessed
- 21 mo ago
Exploit prediction
0.40% chance of exploitation in the next 30 days, higher than 34% of all scored CVEs (FIRST EPSS, 2026-11-08).
Exploits and checks
- geochen.medium.com https://geochen.medium.com/redaxo-cms-5-18-1-cross-site-scripting-7c9a872c72f6 referenced PoC, tagged "exploit" by a source, unverified
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 4.0 | 5.1 | CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N |
| CNA | 3.1 | 2.4 | CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:L/A:N |
| CNA | 3.0 | 2.4 | CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:L/A:N |
| CNA | 2.0 | 3.3 | AV:N/AC:L/Au:M/C:N/I:P/A:N |
| CNA | 4.0 | 5.1 | CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
| NVD | 3.1 | 5.4 | CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N |
| GitHub | 3.1 | 5.4 | CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| packagist | redaxo/source | >=5.12.0-beta1, <5.18.2 |
5.18.2 |
Affected products
- Redaxo CMS
Classification
References
-
github.com
/redaxo/redaxo/commit/74d7391571a29a455a0c477973bc25d25710e424
web
-
geochen.medium.com
/redaxo-cms-5-18-1-cross-site-scripting-7c9a872c72f6
exploit, web, third-party-advisory
-
vuldb.com
/?id.290814
vdb-entry, technical-description, third-party-advisory
-
vuldb.com
/?ctiid.290814
signature, permissions-required, vdb-entry
-
vuldb.com
/?submit.466396
third-party-advisory, vdb-entry
-
github.com
/redaxo/redaxo/security/advisories/GHSA-7wj8-856p-qc9m
web
-
nvd.nist.gov
/vuln/detail/CVE-2024-13209
advisory
-
github.com
/redaxo/redaxo
package
Sources
- CVE List CVE-2024-13209
- GitHub Advisory GHSA-7wj8-856p-qc9m
- NVD CVE-2024-13209
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.