[CVE-2024-38454] ExpressionEngine, Version 7.3.15

CVE

CVE-2024-38454

Published

2024-06-17 00:00

Collected

2026-07-08 00:14

---
id: 3913
title: "[CVE-2024-38454] ExpressionEngine, Version 7.3.15"
cve: CVE-2024-38454
source_domain: bishopfox.com
source_url: "https://bishopfox.com/blog/expressionengine-v-7-3-15-vulnerability"
published_at: "2024-06-17T00:00:00Z"
tags: ["xss", "vulnerability-disclosure", "open-redirect", "cms-security", "expressionengine", "cve-2024-38454"]
phying_url: "https://phying.com/item/3913"
lang: en
---

# [CVE-2024-38454] ExpressionEngine, Version 7.3.15

## Summary

Bishop Fox identified two flaws in Packet Tide's ExpressionEngine 7.3.15, fixed in 7.4.11: unauthenticated XSS (CVE-2024-38454) and open HTTP redirection, which can yield Super Admin accounts.

## Intelligence Metadata

- **Sources:** bishopfox.com
- **CVE:** CVE-2024-38454
- **Published:** 2024-06-17T00:00:00Z
- **Original:** https://bishopfox.com/blog/expressionengine-v-7-3-15-vulnerability
- **Phying News:** https://phying.com/item/3913