PT-2023-12288 · Tpcms · Tpcms

Xrun · Publicado 2023-02-03 · Atualizado 2023-02-09 · CVE-2021-36545

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Média

Vetor base

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions tpcms version 3.2

Description A Cross Site Scripting (XSS) issue allows remote attackers to run arbitrary code via the cfg copyright or cfg tel field in the Site Configuration page. This enables attackers to execute malicious scripts on the website.

Recommendations For tpcms version 3.2, as a temporary workaround, consider restricting access to the Site Configuration page until a patch is available. Avoid using the cfg copyright and cfg tel fields in the Site Configuration page until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2021-36545

Produtos afetados

Tpcms

Referências · 4

• 🔥 https://gitee.com/happy_source/tpcms/issues/I3YUCJ · Exploit
• https://osv.dev/vulnerability/CVE-2021-36545 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2021-36545 · Nota de Segurança
• https://t.me/cibsecurity/57493 · Publicação no Telegram