Phying News
P非影 中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

[CVE-2024-38454] ExpressionEngine, Version 7.3.15

bishopfox.com | vulnerability | CVE-2024-38454 | #xss | #vulnerability-disclosure | #open-redirect | #cms-security | #expressionengine | #cve-2024-38454

Summary

Bishop Fox identified two flaws in Packet Tide's ExpressionEngine 7.3.15, fixed in 7.4.11: unauthenticated XSS (CVE-2024-38454) and open HTTP redirection, which can yield Super Admin accounts.
Published
Collected

original ↗

Related coverage

  1. Grafana CVE-2025-6023 Bypass: A Technical Deep Dive (ethiack.com)
  2. Looking for vulnerabilities in Strapi (CVE-2024-34065) (blog.quarkslab.com)
  3. CVE-2023-54391 and beyond: excavating silent patches and the attacker-defender information gap (yeswehack.com)
  4. A framework for successful vulnerability disclosure policy (yeswehack.com)
  5. Mobilising collective intelligence for better security (yeswehack.com)
  6. Roles and responsibilities for efficient vulnerability disclosure (yeswehack.com)

back