PT-2018-10629 · Creatiwity · Creatiwity Witycms

Nathu Nandwani · Publicado 2018-05-28 · Atualizado 2018-06-29 · CVE-2018-11512

Positive Technologies (AI Summary)

CVSS v3.1

4.8

Média

Vetor base

AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Creatiwity wityCMS version 0.6.1

Description A stored cross-site scripting (XSS) issue exists in the 'Website's name' field of the 'Settings' page under the 'General' menu. This allows remote attackers to inject arbitrary web script or HTML via a crafted website name by sending an authenticated POST HTTP request to the "admin/settings/general" endpoint.

Recommendations For Creatiwity wityCMS version 0.6.1, as a temporary workaround, consider validating and sanitizing user input for the website name variable to prevent XSS attacks. Restrict access to the 'Settings' page under the 'General' menu to minimize the risk of exploitation.

Exploit

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2018-11512

Produtos afetados

Creatiwity Witycms

Referências · 5

• 🔥 https://github.com/Creatiwity/wityCMS/issues/150 · Exploit
• 🔥 https://exploit-db.com/exploits/44790 · Exploit
• https://github.com/Creatiwity/wityCMS/commit/7967e5bf15b4d2ee6b85b56e82d7e1229147de44 · Correção
• https://osv.dev/vulnerability/CVE-2018-11512 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2018-11512 · Nota de Segurança