PT-2023-26681 · Csz Cms+2 · Csz Cms+3

Desencrypt · Publicado 2023-08-18 · Atualizado 2023-08-22 · CVE-2023-38910

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Média

Vetor base

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions CSZ CMS version 1.3.0

Description The issue allows attackers to execute arbitrary web scripts or HTML via a crafted payload entered in the 'Carousel Wiget' section and choosing the carousel widget created above, in 'Photo URL' and 'YouTube URL' plugin. This enables cross-site scripting (XSS) attacks.

Recommendations For CSZ CMS version 1.3.0, as a temporary workaround, consider disabling the 'Carousel Wiget' section and the 'Photo URL' and 'YouTube URL' plugins until a patch is available. Restrict access to these plugins to minimize the risk of exploitation. Avoid using the 'Photo URL' and 'YouTube URL' fields in the 'Carousel Wiget' section until the issue is resolved.

Exploit

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2023-38910

Produtos afetados

Csz Cms

Carousel Wiget

Photo Url

Youtube Url

Referências · 6

• 🔥 https://github.com/desencrypt/CVE/blob/main/CVE-2023-38910/Readme.md · Exploit
• https://t.me/cvenotify/56861 · Publicação no Telegram
• https://nvd.nist.gov/vuln/detail/CVE-2023-38910 · Nota de Segurança
• https://t.me/cvenotify/56891 · Publicação no Telegram
• https://t.me/cibsecurity/68843 · Publicação no Telegram
• https://osv.dev/vulnerability/CVE-2023-38910 · Aviso do Fabricante