PT-2019-17573 · Yunu · Yunucms

Zhouxingixngo · Publicado 2019-01-04 · Atualizado 2019-01-10 · CVE-2019-5310

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Média

Vetor base

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions YUNUCMS version 1.1.8

Description The issue allows for XSS due to crafted data being written to the sys.php file. This can be demonstrated by modifying the site title in an admin/system/basic POST request to "/admin/system/basic".

Recommendations For YUNUCMS version 1.1.8, consider restricting access to the vulnerable System.php controller until a patch is available. Avoid using the site title variable in the affected API endpoint until the issue is resolved.

Exploit

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2019-5310

Produtos afetados

Yunucms

Referências · 3

• 🔥 https://github.com/doublefast/yunucms/issues/6 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2019-5310 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2019-5310 · Aviso do Fabricante