CVE-2024-39311

Publify is a self hosted Web publishing platform on Rails. Prior to version 10.0.1 of Publify, corresponding to versions prior to 10.0.2 of the `publify_core` rubygem, publisher on a `publify` application is able to perform a cross-site scripting (XSS) attack on an administrator using the redirect functionality. The exploitation of this XSS vulnerability requires the administrator to click a malicious link. An attack could attempt to hide their payload by using HTML, or other encodings, as to not make it obvious to an administrator that this is a malicious link. A publisher may attempt to use this vulnerability to escalate their privileges and become an administrator. Version 10.0.1 of Publify and version 10.0.2 of the `publify_core` rubygem fix the issue.

CVSS v3 5.4 MEDIUM

5.4^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.3 / Impact : 2.7

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction REQUIRED

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact NONE

Scope CHANGED

References

Link	Resource
https://github.com/publify/publify/security/advisories/GHSA-8fm5-gg2f-f66q	Exploit Vendor Advisory
https://github.com/publify/publify/security/advisories/GHSA-8fm5-gg2f-f66q	Exploit Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:publify:publify:*:*:*:*:*:*:*:*

Configuration 2 (hide)

cpe:2.3:a:publify:publify_core:*:*:*:*:*:ruby:*:*

History

No history.

Information

Published : 2025-03-28 15:15

Updated : 2025-04-14 14:24

NVD link : CVE-2024-39311

Mitre link : CVE-2024-39311

CVE.ORG link : CVE-2024-39311

JSON object : View

Products Affected

publify

publify_core
publify

CWE

CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

{"id": "CVE-2024-39311", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 5.4, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}, "impactScore": 2.7, "exploitabilityScore": 2.3}], "cvssMetricV40": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 1.8, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "LOW", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "PROOF_OF_CONCEPT", "providerUrgency": "NOT_DEFINED", "userInteraction": "ACTIVE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "HIGH", "subIntegrityImpact": "LOW", "vulnIntegrityImpact": "NONE", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "LOW", "vulnConfidentialityImpact": "NONE", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "published": "2025-03-28T15:15:44.647", "references": [{"url": "https://github.com/publify/publify/security/advisories/GHSA-8fm5-gg2f-f66q", "tags": ["Exploit", "Vendor Advisory"], "source": "security-advisories@github.com"}, {"url": "https://github.com/publify/publify/security/advisories/GHSA-8fm5-gg2f-f66q", "tags": ["Exploit", "Vendor Advisory"], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-79"}]}], "descriptions": [{"lang": "en", "value": "Publify is a self hosted Web publishing platform on Rails. Prior to version 10.0.1 of Publify, corresponding to versions prior to 10.0.2 of the `publify_core` rubygem, publisher on a `publify` application is able to perform a cross-site scripting (XSS) attack on an administrator using the redirect functionality. The exploitation of this XSS vulnerability requires the administrator to click a malicious link. An attack could attempt to hide their payload by using HTML, or other encodings, as to not make it obvious to an administrator that this is a malicious link. A publisher may attempt to use this vulnerability to escalate their privileges and become an administrator. Version 10.0.1 of Publify and version 10.0.2 of the `publify_core` rubygem fix the issue."}, {"lang": "es", "value": "Publify es una plataforma de publicaci\u00f3n web autoalojada en Rails. Antes de la versi\u00f3n 10.0.1 de Publify, correspondiente a las versiones anteriores a la 10.0.2 de la gema `publify_core`, un editor en una aplicaci\u00f3n `publify` pod\u00eda realizar un ataque de Cross Site Scripting (XSS) contra un administrador mediante la funci\u00f3n de redireccionamiento. Para explotar esta vulnerabilidad XSS, el administrador debe hacer clic en un enlace malicioso. Un ataque podr\u00eda intentar ocultar su payload mediante HTML u otras codificaciones para que el administrador no note que se trata de un enlace malicioso. Un editor podr\u00eda intentar aprovechar esta vulnerabilidad para aumentar sus privilegios y convertirse en administrador. Las versiones 10.0.1 de Publify y 10.0.2 de la gema `publify_core` solucionan el problema."}], "lastModified": "2025-04-14T14:24:49.550", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:publify:publify:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "87C5F03F-C0E9-41ED-B498-E03CF3CA27DF", "versionEndExcluding": "10.0.1"}], "operator": "OR"}]}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:publify:publify_core:*:*:*:*:*:ruby:*:*", "vulnerable": true, "matchCriteriaId": "17C10FE3-54A1-4D58-8A4E-9F6A58C69B5D", "versionEndExcluding": "10.0.2"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}