PT-2019-6667 · Zikula · Zikula

Jan Lieskovsky · Publicado 2019-11-19 · Atualizado 2019-11-21 · CVE-2011-3352

Positive Technologies (AI Summary)

CVSS v2.0

3.5

Baixa

Vetor base

AV:N/AC:M/Au:S/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Zikula versions prior to 1.3.0 build #3168

Description The issue is due to improper sanitization of the themename parameter, allowing a remote attacker with administrator privileges to execute arbitrary HTML or web script code in the context of the affected website by setting default, modifying, and deleting themes.

Recommendations For versions prior to 1.3.0 build #3168, avoid using the themename parameter in theme management until a fix is available. As a temporary workaround, consider restricting access to theme modification and deletion functionality to minimize the risk of exploitation.

Exploit

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2011-3352

Produtos afetados

Zikula

Referências · 4

• 🔥 https://immuniweb.com/advisory/HTB23039 · Exploit
• https://access.redhat.com/security/cve/cve-2011-3352 · Nota
• https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2011-3352 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2011-3352 · Nota de Segurança