CVE-2024-21622: 
PHP vulnerability analysis and mitigation

Craft CMS versions 3.x prior to 3.9.6 and 4.x prior to 4.4.16 contain a moderate impact, low complexity privilege escalation vulnerability that affects certain user permissions setups. The vulnerability was discovered and disclosed on January 3, 2024 (GitHub Advisory).

The vulnerability has been assigned CVE-2024-21622 with a CVSS v3.1 base score of 8.8 HIGH (NIST) and 5.4 MEDIUM (GitHub). The CVSS vector string is CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:L, indicating adjacent network attack vector, low attack complexity, low privileges required, no user interaction needed, changed scope, and low impact on integrity and availability (NVD).

The vulnerability could allow privilege escalation for users with certain permission setups in Craft CMS installations. While specific details about the potential impact are limited, the vulnerability affects both the integrity and availability of the system with low severity (GitHub Advisory).

The vulnerability has been patched in Craft CMS versions 4.4.16 and 3.9.6. Users are advised to upgrade to at least these versions to mitigate the vulnerability. No alternative workarounds have been published (GitHub Advisory).