p PatchFirst

CVE-2024-47836

CVE-2024-47836 · Admidio vulnerable to HTML Injection In The Messages Section

This page contains facts from public vulnerability sources. Check the original advisory before updating.

Admidio is an open-source user management solution. Prior to version 4.3.12, an unsafe deserialization vulnerability allows any unauthenticated user to execute arbitrary code on the server. Version 4.3.12 fixes this issue.

CVSS 3.5 · Low · EPSS 0.5% · Fix available

Published
Updated

Stack: php

Affected products and versions

  • admidio

    Versions
    • < 4.3.12: Affected

    No fix published

  • admidio/admidio Packagist

    Versions
    • 4.1.0
    • 4.1.3
    • v4.2-Beta.1
    • v4.2-Beta.2
    • v4.2-Beta.3
    • v4.2.0
    • v4.2.1
    • v4.2.10
    • v4.2.11
    • v4.2.12
    • v4.2.13
    • v4.2.14
    • v4.2.2
    • v4.2.3
    • v4.2.4
    • v4.2.5
    • v4.2.6
    • v4.2.7
    • v4.2.8
    • v4.2.9
    • v4.3-Beta.1
    • v4.3-Beta.3
    • v4.3-Beta.4
    • v4.3-Beta.5
    • v4.3.0
    • v4.3.1
    • v4.3.10
    • v4.3.11
    • v4.3.2
    • v4.3.3
    • v4.3.4
    • v4.3.5
    • v4.3.6
    • v4.3.7
    • v4.3.8
    • v4.3.9
    Affected ranges
    • ECOSYSTEM: < 4.3.12

    Update to 4.3.12

Original sources

Check your server →