PatchSiren

PatchSiren cyber security CVE debrief

CVE-2024-56145 Craft CMS CVE debrief

CVE-2024-56145 is a Craft CMS code injection vulnerability that CISA added to its Known Exploited Vulnerabilities catalog on 2025-06-02. That KEV listing means defenders should treat it as an urgent remediation item, especially for internet-facing or cloud-hosted Craft CMS deployments, and work from the official Craft CMS advisory and CISA guidance to mitigate exposure before the 2025-06-23 due date.

Vendor
Craft CMS
Product
Craft CMS
CVSS
CRITICAL 9.3
CISA KEV
Listed
Original CVE published
2025-06-02
Original CVE updated
2025-06-02
Advisory published
2025-06-02
Advisory updated
2025-06-02

Who should care

Craft CMS administrators, security teams, and service owners running public-facing or cloud-hosted Craft CMS instances should prioritize this immediately. Asset managers and incident response teams should also review exposure, because CISA has placed the CVE in KEV, indicating known exploitation.

Technical summary

The supplied corpus identifies the issue as a code injection vulnerability in Craft CMS. No CVSS score, affected version range, or exploit mechanics are included in the provided data. The strongest technical signal available here is CISA's KEV entry, which confirms the vulnerability is known to be exploited and elevates the need for vendor-directed remediation.

Defensive priority

Urgent

Recommended defensive actions

  • Review the official Craft CMS security advisory referenced by CISA and apply the vendor-recommended fix or mitigation as soon as possible.
  • Inventory all Craft CMS installations, with special attention to internet-facing and cloud-hosted systems.
  • Follow CISA BOD 22-01 guidance for cloud services where applicable.
  • If a safe mitigation is not available, isolate or discontinue use of the affected product until a fix can be applied.
  • Validate remediation before the CISA KEV due date of 2025-06-23.

Evidence notes

This debrief is grounded in the supplied CISA KEV source item for CVE-2024-56145, which names Craft CMS and classifies the issue as a code injection vulnerability. The corpus confirms KEV inclusion on 2025-06-02 and a remediation due date of 2025-06-23, but does not provide CVSS, affected versions, or exploitation details beyond the known-exploited designation. CISA's notes reference the Craft CMS GitHub security advisory and the NVD entry.

Sources and references

Verified primary and authoritative sources

  • CVE-2024-56145 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2024-56145

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2024-56145 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2024-56145

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

  • CISA Known Exploited Vulnerabilities catalog

    Publisher, destination, and source semantics verified

    URL: https://www.cisa.gov/known-exploited-vulnerabilities-catalog

    Cybersecurity and Infrastructure Security Agency - Official CISA catalog of vulnerabilities known to be exploited in the wild.

Supplemental references

  • Source item URL

    Unverified legacy reference

    URL: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json

    cisa_kev

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.