PT-2023-12406 · Slackero · Phpcms

Slackero · Publicado 2023-01-04 · Atualizado 2024-05-17 · CVE-2021-4302

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Média

Vetor base

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions slackero phpwcms versions up to 1.9.26

Description A vulnerability was found in the SVG File Handler component of slackero phpwcms, which can be exploited to lead to cross site scripting. The manipulation can be initiated remotely.

Recommendations For versions up to 1.9.26, upgrade to version 1.9.27 to address this issue.

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2021-4302

Produtos afetados

Phpcms

Referências · 8

• https://github.com/slackero/phpwcms/releases/tag/v1.9.27 · Correção
• https://github.com/slackero/phpwcms/commit/b39db9c7ad3800f319195ff0e26a0981395b1c54 · Correção
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-4302 · Nota
• https://vuldb.com/?ctiid.217419 · Nota
• https://osv.dev/vulnerability/CVE-2021-4302 · Aviso do Fabricante
• https://vuldb.com/?id.217419 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2021-4302 · Nota de Segurança
• https://t.me/cibsecurity/55921 · Publicação no Telegram