{"id":"CVE-2024-24570","aliases":["GHSA-vqxq-hvxw-9mv9"],"url":"https://o3.security/vulnerability/CVE-2024-24570","summary":"Statamic account takeover via XSS and password reset link","details":"### Impact\n\nHTML files crafted to look like jpg files are able to be uploaded, allowing for XSS.\n\nThis affects:\n\n- front-end forms with asset fields without any mime type validation\n- asset fields in the control panel\n- asset browser in the control panel\n\nAdditionally, if the XSS is crafted in a specific way, the \"copy password reset link\" feature may be exploited to gain access to a user's password reset token and gain access to their account. The authorized user is required to execute the XSS in order for the vulnerability to occur.\n\n### Patches\n\nIn versions 4.46.0 and 3.4.17, the XSS vulnerability has been patched, and the copy password reset link functionality has been disabled. (Users may still trigger password reset emails.)\n\n### Credits\n\nStatamic thanks Niklas Schilling (discovery, analysis, coordination) from the SEC Consult Vulnerability Lab (https://www.sec-consult.com/) for responsibly reporting the identified issues and working with us as we addressed them.","published":"2024-02-01T16:42:57.717Z","modified":"2026-08-12T03:51:16.153043374Z","cvss":{"score":8.2,"severity":"HIGH","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N"},"epss":{"score":0.00734,"percentile":0.52656,"asOf":"2026-09-16"},"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"Packagist","name":"statamic/cms","fixedVersion":"4.46.0"},{"ecosystem":"Packagist","name":"statamic/cms","fixedVersion":"3.4.17"}],"fix":null,"references":[{"type":"WEB","url":"http://packetstormsecurity.com/files/177133/Statamic-CMS-Cross-Site-Scripting.html"},{"type":"WEB","url":"http://seclists.org/fulldisclosure/2024/Feb/17"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/24xxx/CVE-2024-24570.json"},{"type":"ADVISORY","url":"https://github.com/statamic/cms/security/advisories/GHSA-vqxq-hvxw-9mv9"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2024-24570"},{"type":"PACKAGE","url":"https://github.com/statamic/cms"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-08-12T03:51:16.153043374Z"}}