Detections
Analytics

SCA: security update for getkirby/cms (GHSA-jm9m-rqr3-wfmh)

high Tenable Self-Hosted Container Security Plugin ID 416456

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - Kirby is a CMS targeting designers and editors. Kirby allows to restrict the permissions of specific user
 roles. Users of that role can only perform permitted actions. Permissions for creating and deleting
 languages have already existed and could be configured, but were not enforced by Kirby's frontend or
 backend code. A permission for updating existing languages has not existed before the patched versions. So
 disabling the languages.* wildcard permission for a role could not have prohibited updates to existing
 language definitions. The missing permission checks allowed attackers with Panel access to manipulate the
 language definitions. The problem has been patched in Kirby 3.6.6.6, Kirby 3.7.5.5, Kirby 3.8.4.4, Kirby
 3.9.8.2, Kirby 3.10.1.1, and Kirby 4.3.1. Please update to one of these or a later version to fix the
 vulnerability. There are no known workarounds for this vulnerability. (CVE-2024-41964)

See Also

https://github.com/advisories/GHSA-jm9m-rqr3-wfmh

Plugin Details

Severity: High

ID: 416456

Version: Revision 1.8

Type: Local

Family: SCA Checks

Published: 1/23/2025

Updated: 7/2/2026

Supported Sensors: Tenable Cloud Security, Tenable Self-Hosted Container Security

Risk Information

VPR

Risk Factor: Medium

Score: 4.3

Percentile: 53.37

Vendor

Vendor Severity: High

CVSS v2

Risk Factor: High

Base Score: 8.5

Temporal Score: 6.3

Vector: CVSS2#AV:N/AC:L/Au:S/C:N/I:C/A:C

CVSS Score Source: CVE-2024-41964

CVSS v3

Risk Factor: High

Base Score: 8.1

Temporal Score: 7.1

Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

CVSS v4

Risk Factor: High

Base Score: 8.8

Threat Score: 6.8

Threat Vector: CVSS:4.0/E:U

Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N

Vulnerability Information

Exploit Ease: No known exploits are available

Patch Publication Date: 8/29/2024

Vulnerability Publication Date: 8/29/2024

Reference Information

CVE: CVE-2024-41964

cwe: CWE-863