{"id":"CVE-2024-39311","aliases":["GHSA-8fm5-gg2f-f66q"],"url":"https://o3.security/vulnerability/CVE-2024-39311","summary":"Publify Vulnerable To Cross-Site Scripting (XSS) Via Redirects Requiring User Interaction","details":"Publify is a self hosted Web publishing platform on Rails. Prior to version 10.0.1 of Publify, corresponding to versions prior to 10.0.2 of the `publify_core` rubygem, publisher on a `publify` application is able to perform a cross-site scripting (XSS) attack on an administrator using the redirect functionality. The exploitation of this XSS vulnerability requires the administrator to click a malicious link. An attack could attempt to hide their payload by using HTML, or other encodings, as to not make it obvious to an administrator that this is a malicious link. A publisher may attempt to use this vulnerability to escalate their privileges and become an administrator. Version 10.0.1 of Publify and version 10.0.2 of the `publify_core` rubygem fix the issue.","published":"2025-03-28T14:38:03.816Z","modified":"2026-07-15T01:48:58.537786088Z","cvss":null,"epss":null,"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"RubyGems","name":"publify_core","fixedVersion":"10.0.2"}],"fix":null,"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/39xxx/CVE-2024-39311.json"},{"type":"ADVISORY","url":"https://github.com/publify/publify/security/advisories/GHSA-8fm5-gg2f-f66q"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2024-39311"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-07-15T01:48:58.537786088Z"}}