CVE-2024-27087 json
Kirby cross-site scripting (XSS) in the link field "Custom" type
published 2y ago modified 2mo ago also EUVD-2024-0528 , GHSA-63h4-w25c-3qv4
- cvss
- 4.6
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.3%
- EPSS 0.3% chance of exploitation in 30 days, percentile 28%
- public exploits
- 0
- none known
Summary
Kirby is a content management system. The new link field introduced in Kirby 4 allows several different link types that each validate the entered link to the relevant URL format. It also includes a "Custom" link type for advanced use cases that don't fit any of the pre-defined link formats. As the "Custom" link type is meant to be flexible, it also allows the javascript: URL scheme. In some use cases this can be intended, but it can also be misused by attackers to execute arbitrary JavaScript code when a user or visitor clicks on a link that is generated from the contents of the link field. This vulnerability is patched in 4.1.1.
Patch / fix
- packagist getkirby/cms 4.1.1
- getkirby kirby 4.1.1
Is CVE-2024-27087 in your dependencies? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.
Check with FencerCISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- partial
- Assessed
- 2y ago
Exploit prediction
0.35% chance of exploitation in the next 30 days, higher than 28% of all scored CVEs (FIRST EPSS, 2026-11-11).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 4.6 | CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N |
| GitHub | 3.1 | 4.6 | CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N |
| NVD | 3.1 | 5.4 | CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| packagist | getkirby/cms | >=4.0.0, <4.1.1 |
4.1.1 |
Affected products
- getkirby kirby
Classification
- Weakness
-
- CWE-79 Improper Neutralization of Input During Web Page Generation
References
-
github.com
/getkirby/kirby/commit/cda3dd9a15228d35e62ff86cfa87a67e7c687437
web, patch
-
github.com
/getkirby/kirby/security/advisories/GHSA-63h4-w25c-3qv4
web, vendor-advisory
-
nvd.nist.gov
/vuln/detail/CVE-2024-27087
advisory
-
github.com
/getkirby/kirby
package
-
github.com
/getkirby/kirby/releases/tag/4.1.1
web
Sources
- CVE List CVE-2024-27087
- GitHub Advisory GHSA-63h4-w25c-3qv4
- NVD CVE-2024-27087
Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.
CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.