{"id":"CVE-2024-45406","published":"2024-09-09T16:46:26Z","modified":"2024-09-09T19:59:08Z","title":"Craft CMS stored XSS in breadcrumb list and title fields","vendor":"Craft CMS","product":"cms","tier":"tail","description":{"text":"Craft is a content management system (CMS). Craft CMS 5 stored XSS can be triggered by the breadcrumb list and title fields with user input.","provenance":"source","from":"CVE.org"},"cvss":{"score":5.5,"severity":"MEDIUM","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L","provenance":"source","from":"CVE.org CNA"},"epss":{"score":0.00354,"percentile":0.29049,"provenance":"source"},"cwes":[{"id":"CWE-80","name":"Improper Neutralization of Script-Related HTML Tags in a Web Page"},{"id":"CWE-79","name":"Improper Neutralization of Input During Web Page Generation"}],"references":[{"url":"https://github.com/craftcms/cms/security/advisories/GHSA-28h4-788g-rh42","tags":["x_refsource_CONFIRM"]},{"url":"https://github.com/craftcms/cms/commit/b7348942f8131b3868ec6f46d615baae50151bb8","tags":["x_refsource_MISC"]}],"priority":{"score":9.7,"factors":[{"name":"EPSS percentile","points":5.81},{"name":"CVSS severity","points":3.85}]},"vendorSlug":"craft-cms","affectedVersions":[{"vendor":"craftcms","product":"cms","versions":[">= 5.0.0, < 5.1.2"]}],"affected":[{"ecosystem":"Packagist","package":"craftcms/cms","vulnerableRanges":[">=5.0.0, <5.1.2"],"patched":["5.1.2"],"from":["GHSA-28h4-788g-rh42"],"provenance":"source"}],"euvd":{"id":"EUVD-2024-2692","exploited":false,"provenance":"source"}}