Cyber Resilience

CVE-2024-5737

MediumPublic PoC

Published: 28 June 2024

Published
28 June 2024
Modified
21 November 2024
KEV Added
Patch
CVSS Score v4 6.3 CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:U/V:D/RE:L/U:Green
EPSS Score 0.1611 94.9th percentile
Risk Priority 22 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2024-5737 is a medium-severity Cross-site Scripting (CWE-79) vulnerability in Admiror-Design-Studio Admirorframes. Its CVSS base score is 6.3 (Medium).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 5.1% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

Deeper analysis

The vulnerability affects the afGdStream.php script in the AdmirorFrames Joomla! extension prior to version 5.0. Because the script does not set a Content-Type header, responses default to text/html, allowing an attacker to embed HTML tags directly inside image data that is later rendered by a browser as executable markup. The issue is tracked as CWE-79 with a CVSS 4.0 score of 6.3.

An unauthenticated attacker can supply a malicious image file that is processed by the affected script. When the resulting page is viewed, the embedded HTML executes in the context of the victim’s browser, enabling limited integrity and availability impacts without requiring user interaction or privileges.

Public references include technical write-ups from cert.pl and multiple GitHub repositories containing further analysis and proof-of-concept material. The EPSS score has remained flat at 0.1611 with no material increase since disclosure.

EU & UK References

Vulnerability details

Script afGdStream.php in AdmirorFrames Joomla! extension doesn’t specify a content type and as a result default (text/html) is used. An attacker may embed HTML tags directly in image data which is rendered by a webpage as HTML. This issue affects…

more

AdmirorFrames: before 5.0.

CWE(s)

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
T1059.007 JavaScript Execution
Adversaries may abuse various implementations of JavaScript for execution.
Why these techniques?

The XSS vulnerability (CWE-79) in afGdStream.php allows attackers to inject HTML/JavaScript into image data rendered as text/html, enabling exploitation of a public-facing web application (T1190) and JavaScript execution in victim browsers (T1059.007).

Affected Assets

admiror-design-studio
admirorframes
≤ 5.0

Mitigating Controls

Likely Mitigating Controls AI

Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.

addresses: CWE-79

Penetration testing submits XSS payloads to web applications, detecting cross-site scripting flaws for subsequent remediation.

addresses: CWE-79

Validates web inputs to reject script-related content that could produce XSS.

addresses: CWE-79

Output validation against expected content can reject or sanitize script content in generated web pages, reducing XSS exploitability.

References