CVE-2024-50803 identifies a Cross Site Scripting (CWE-79) vulnerability in the mediapool feature of Redaxo Core CMS version 5.17.1. The vulnerability permits a remote attacker with low privileges to execute script code in the context of another user, potentially escalating their privileges within the application. The CVSS 3.1 base score is 6.1, reflecting network attack vector, low attack complexity, required privileges, user interaction, and partial confidentiality and integrity impact. No patch or vendor advisory is currently provided, and no known exploits are reported in the wild.

Successful exploitation of this XSS vulnerability can lead to privilege escalation by allowing an attacker to execute malicious scripts in the context of an authenticated user. This can compromise confidentiality and integrity of data accessible to the victim user. Availability is not impacted. The attack requires the attacker to have some privileges and user interaction to succeed.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should exercise caution with mediapool inputs and consider applying any available workarounds or input sanitization measures recommended by the vendor. Monitor for updates from Redaxo regarding patches or mitigations.