CVE-2024-54774 is an XSS bug in Dcat Admin 2.2.0-beta’s /admin/articles/create page, where a logged-in attacker may be able to run JavaScript in other users’ browsers—typical small businesses should be concerned mainly if you have multiple user accounts and an attacker could reach the admin area.
Dcat Admin v2.2.0-beta has a cross-site scripting (XSS) vulnerability in the /admin/articles/create endpoint that can be triggered by a user with user-level access to inject JavaScript executed in other users’ browser sessions via a browser page view.
If you're affected
Account actions under victim session
Admin interface defacement
Session theft risk
Sensitive data exposure
What is it
This bug lets a user who can reach the article creation function put in “active” web content (JavaScript) instead of plain text. If another user then views the affected admin page, the injected script can run inside their browser session. Think of it like slipping a note written with commands into a form—when someone else opens the page, their browser may follow those commands.
Who is affected
This matters if you run Dcat Admin and have the /admin/articles/create feature in use, especially in environments with multiple user accounts. The findings indicate an attacker needs user-level access and the victim must view the affected page, so the main risk is when someone can already log in (or otherwise reach that admin function). The exact “reachable from the internet by default” detail is not known from the available findings.
How urgent is it
This is a GREEN issue: there’s no public exploit code on record and no KEV listing. The risk is still real because an attacker with user-level access can inject JavaScript that runs when other users view the page, but the prerequisites (user access and page viewing) make it less likely to affect everyone immediately.
What to do — in detail
Confirm exposure: identify your Dcat Admin version. If it is 2.2.0-beta, and you use the /admin/articles/create endpoint, treat this as applicable.
Confirm the risky behavior: inspect the article creation flow and the rendered output on/around /admin/articles/create. Specifically look for any user-controlled fields that are inserted into HTML/JavaScript contexts without proper output escaping.
Determine an upgrade target: the available findings do not include a specific fixed version or patch artifact for CVE-2024-54774. Check Dcat Admin’s vendor release notes / security advisories for the patched release, and schedule an upgrade to that fixed version.
Temporary workaround (while patching is pending):
Restrict access to the admin area so only trusted users can reach article creation.
If your configuration supports it, limit roles/permissions so the fewest users can create or influence the content that might be rendered to others.
Add/verify output encoding (proper HTML escaping) for any user-supplied text that is displayed in the admin UI.
What to monitor: watch for abnormal admin activity around article creation, unusual changes to article content, and any signs that administrators are loading unexpected scripts when viewing admin pages.
KEV timing: CVE-2024-54774 is not listed in the CISA KEV set based on the provided findings.
Technical context
Severity is listed as medium by CVSS (4.8), but the practical risk depends on prerequisites. The weakness is CWE-79 (cross-site scripting). Mechanism: an attacker with user-level access injects malicious JavaScript through the /admin/articles/create endpoint, which then executes in the context of other users’ browser sessions when they view the affected pages (requires user interaction: the victim has to view the page). Exploitation status: no public exploit code is on record; KEV has no listing. Patch availability: no fixed version/patch details were found in the provided findings. EPSS is only a prediction (0.3% with a flat trend), and there is no KEV/news confirmation of exploitation in the provided data.
This is a general assessment based on public vulnerability data. It does not account for your specific infrastructure — when in doubt, consult a security specialist.
