cbcvebase.
CVE-2024-47374
published 2024-10-05

CVE-2024-47374: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in LiteSpeed Technologies LiteSpeed Cache litespeed-cache…

PriorityP183medium6.1CVSS 3.1
AVNACLPRNUIRSCCLILAN
ITWEXPLOITVulnCheck KEVRansomware
Exploited in the wild
EPSS
1.41%
69.3th percentile
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in LiteSpeed Technologies LiteSpeed Cache litespeed-cache allows Stored XSS.This issue affects LiteSpeed Cache: from n/a through <= 6.5.0.2.

Affected

2 ranges
VendorProductVersion rangeFixed in
litespeed_technologieslitespeed_cache<= 6.5.0.2
litespeedtechlitespeed_cache< 6.5.16.5.1

Detection & IOCsextracted from sources · hover to see the quote

url/wp-admin/admin.php?page=litespeed-page_optm
yara
contains_all(body, ">alert(1)","litespeed")
  • Probe for successful exploitation by checking that the HTTP 200 response body contains both the XSS payload string '>alert(1)' and the string 'litespeed' on the LiteSpeed Cache page optimization admin page (/wp-admin/admin.php?page=litespeed-page_optm).
  • Fingerprint LiteSpeed Cache presence on a target by checking for the response header 'X-Litespeed-Tag' containing the value '2d2_HTTP.200' with an HTTP 200 status code.
  • The attack requires an authenticated session (administrator login); monitor for POST requests to /wp-login.php followed by access to the LiteSpeed Cache page optimization admin endpoint.
  • Successful admin authentication is confirmed by a 302 redirect response containing the 'wordpress_logged_in' cookie; subsequent access to the litespeed-page_optm page with a stored XSS payload indicates exploitation.
  • CVE-2024-47374 affects LiteSpeed Cache versions up to and including 6.5.0.2; flag installations running these versions as vulnerable.
  • ·Exploitation requires authenticated access (administrator-level login to WordPress) before the stored XSS payload on the LiteSpeed Cache page optimization settings can be triggered.
  • ·The vulnerability is a Stored XSS (not reflected), meaning the payload persists in the plugin's settings and will execute for any user who visits the affected admin page.

CVSS provenance

nvdv3.16.1MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
vulncheck6.1MEDIUM
CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.