Cross-site Scripting in a field that is used in the Content name pattern in ibexa/admin-ui
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- Passive
- Attack complexity
- Low
- Attack requirements
- None
- Impact type
- Cross-site scripting
- Confidentiality · integrity · availability
- Low · Low · Low
- Fix status
- Fixed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA and GitHub. Impact type from CWE-79.
Summary
Ibexa Admin UI Bundle is all the necessary parts to run the Ibexa DXP Back Office interface. The Content name pattern is used to build Content names from one or more fields. An XSS vulnerability has been found in this mechanism. Content edit permission is required to exploit it. After the fix, any existing injected XSS will not run. This issue has been patched in version 4.6.14. All users are advised to upgrade. There are no known workarounds for this vulnerability.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| ibexa | admin-ui | 4.6.0 to before 4.6.14 | 4.6.14 | Patch available | CNA |
| — | ibexa/admin-ui (Packagist) | 4.6.0 to before 4.6.14 | 4.6.14 | Patch available | GHSA-8w3p-gf85-qcch |
- admin-ui Vendoribexa Affected 4.6.0 to before 4.6.14 Fixed in 4.6.14 Patch available CNA
- ibexa/admin-ui (Packagist) Vendor— Affected 4.6.0 to before 4.6.14 Fixed in 4.6.14 Patch available GHSA-8w3p-gf85-qcch
Remediation
- Fix · CNA admin-ui (ibexa) Fixed in 4.6.14
- Fix · GHSA-8w3p-gf85-qcch ibexa/admin-ui (Packagist) Fixed in 4.6.14 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2024-53864
- 2026-10-03 Alias added: GHSA-8w3p-gf85-qcch
References
Other 5
- https://github.com/ibexa/admin-ui/security/advisories/GHSA-8w3p-gf85-qcch
- https://github.com/ibexa/admin-ui/commit/8ec824a8cf06c566ed88e4c21cc66f7ed42649fc
- https://developers.ibexa.co/security-advisories/ibexa-sa-2024-006-vulnerabilities-in-content-name-pattern-commerce-shop-and-varnish-vhost-templates
- https://doc.ibexa.co/en/latest/update_and_migration/from_4.6/update_from_4.6/#v4614
- https://github.com/ibexa/admin-ui
More ibexa vulnerabilities
- TI-2022-23981 An issue was discovered in eZ Publish Ibexa Kernel before 7.5.28. CVSS 3.1CRITICAL 9.8
- TI-2022-09029 Ibexa DXP ezsystems/ezpublish-kernel 7.5.x before 7.5.26 and 1.3.x before 1.3.12 allows… CVSS 3.1CRITICAL 9.8
- TI-2022-20217 ezplatform-graphql GraphQL queries can expose password hashes CVSS 3.1HIGH 7.5
- TI-2025-43106 Incorrect access control in the REST API of Ibexa & Ciril GROUP eZ Platform / Ciril… CVSS 3.1HIGH 7.5
- TI-2025-41415 Ibexa User Bundle is missing password change validation CVSS 4.0HIGH 8.5
- TI-2024-29020 Persistent Cross-site Scripting in Ibexa RichText Field Type CVSS 3.1HIGH 7.2
Sources
- CVE-2024-53864 · CVE Program
- CVE-2024-53864 · NVD
- FIRST EPSS
- GHSA-8w3p-gf85-qcch · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences