vulntracker.iovulntracker.io
© 2026 vulntracker.io

CVE-2024-53864

Cross-site Scripting in a field that is used in the Content name pattern in ibexa/admin-ui

MEDIUM
5.3
CVSS Score
Published: November 29, 2024 at 06:45 PM UTC
Updated: June 17, 2026 at 08:09 AM UTC
1 product affected across 1 vendorAdmin UI

Using admin-ui by ibexa?

Get instant alerts when new vulnerabilities affect admin-ui - before attackers find them.

Real-time alertsTrack your software stackFree plan available
Start FreeSign In
Severity
MEDIUM5.3
Exploit prediction
EPSS 0.5%
SSVC
No known exploit

Description

Ibexa Admin UI Bundle is all the necessary parts to run the Ibexa DXP Back Office interface. The Content name pattern is used to build Content names from one or more fields. An XSS vulnerability has been found in this mechanism. Content edit permission is required to exploit it. After the fix, any existing injected XSS will not run. This issue has been patched in version 4.6.14. All users are advised to upgrade. There are no known workarounds for this vulnerability.

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

Admin UI· Ibexa
60%
v < 4.6.14
Affected range stops below 4.6.14, so it looks safe — our inference, not a vendor statement

Remediation

No guide yet

No remediation guidance has been written for this CVE yet, and no fixed version or vendor advisory is recorded against it.

References (4)

x_refsource_MISC
Source: [email protected]
https://developers.ibexa.co/security-advisories/ibexa-sa-2024-006-vulnerabilities-in-content-name-pattern-commerce-shop-and-varnish-vhost-templates
x_refsource_MISC
Source: [email protected]
https://doc.ibexa.co/en/latest/update_and_migration/from_4.6/update_from_4.6/#v4614
x_refsource_MISC
Source: [email protected]
https://github.com/ibexa/admin-ui/commit/8ec824a8cf06c566ed88e4c21cc66f7ed42649fc
x_refsource_CONFIRM
Source: [email protected]
https://github.com/ibexa/admin-ui/security/advisories/GHSA-8w3p-gf85-qcch

SSVC — Action Prioritization

SSVCNo known exploitNot automatablePartial impact

SSVC signals action urgency (what to patch first), separate from CVSS which measures severity.

CVSS

5.3MEDIUMGitHub_M
Vector?

Quick Info

StatusDEFERRED
CWE
CWE-79

Get alerted

Stop reading CVE feeds looking for your own stack

Track the products you run and VulnTracker tells you when a new CVE affects them — with what is known about fixing it, and nothing about the rest.

Create accountSign in
Free plan, no card