« Volver al listado

CVE-2024-32875

Estado: AplazadaMedia (6.1)—

Hugo is a static site generator. Starting in version 0.123.0 and prior to version 0.125.3, title arguments in Markdown for links and images not escaped in internal render hooks. Hugo users who are impacted are those who have these hooks enabled and do not trust their Markdown content files. The issue is patched in v0.125.3. As a workaround, replace the templates with user defined templates or disable the internal templates.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.

Gohugo — HugoAI

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2024-32875",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2024-32875",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2024-04-29T19:39:12.988615Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "security-advisories@github.com",
        "cvssData": {
          "scope": "CHANGED",
          "version": "3.1",
          "baseScore": 6.1,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
          "integrityImpact": "LOW",
          "userInteraction": "REQUIRED",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "LOW"
        },
        "impactScore": 2.7,
        "exploitabilityScore": 2.8
      }
    ]
  },
  "affected": [
    {
      "source": "security-advisories@github.com",
      "affectedData": [
        {
          "vendor": "gohugoio",
          "product": "hugo",
          "versions": [
            {
              "status": "affected",
              "version": ">= 0.123.0, < 0.125.3"
            }
          ]
        }
      ]
    },
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "affectedData": [
        {
          "cpes": [
            "cpe:2.3:a:gohugo:hugo:0.123.0:*:*:*:*:*:*:*"
          ],
          "vendor": "gohugo",
          "product": "hugo",
          "versions": [
            {
              "status": "affected",
              "version": "0.123.0",
              "lessThan": "0.125.3",
              "versionType": "custom"
            }
          ],
          "defaultStatus": "unknown"
        }
      ]
    }
  ],
  "published": "2024-04-23T21:15:48.837",
  "references": [
    {
      "url": "https://github.com/gohugoio/hugo/releases/tag/v0.125.3",
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/gohugoio/hugo/security/advisories/GHSA-ppf8-hhpp-f5hj",
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://gohugo.io/getting-started/configuration-markup/#renderhooksimageenabledefault",
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/gohugoio/hugo/releases/tag/v0.125.3",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://github.com/gohugoio/hugo/security/advisories/GHSA-ppf8-hhpp-f5hj",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://gohugo.io/getting-started/configuration-markup/#renderhooksimageenabledefault",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "security-advisories@github.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-79"
        },
        {
          "lang": "en",
          "value": "CWE-80"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Hugo is a static site generator. Starting in version 0.123.0 and prior to version 0.125.3, title arguments in Markdown for links and images not escaped in internal render hooks. Hugo users who are impacted are those who have these hooks enabled and do not trust their Markdown content files. The issue is patched in v0.125.3. As a workaround, replace the templates with user defined templates or disable the internal templates."
    },
    {
      "lang": "es",
      "value": "Hugo es un generador de sitios estáticos. A partir de la versión 0.123.0 y antes de la versión 0.125.3, los argumentos de título en Markdown para enlaces e imágenes no escaparon en ganchos de renderizado internos. Los usuarios de Hugo que se ven afectados son aquellos que tienen estos enlaces habilitados y no confían en sus archivos de contenido de Markdown. El problema se solucionó en v0.125.3. Como workaround, reemplace las plantillas con plantillas definidas por el usuario o desactive las plantillas internas."
    }
  ],
  "lastModified": "2026-06-17T07:30:35.933",
  "sourceIdentifier": "security-advisories@github.com"
}