PT-2015-3499 · Spitfire · Spitfire Cms
Published
2015-01-01
·
Updated
2015-01-03
·
CVE-2011-5303
CVSS v2.0
4.3
Medium
| Vector | AV:N/AC:M/Au:N/C:N/I:P/A:N |
Name of the Vulnerable Software and Affected Versions
Spitfire CMS version 1.0.436
Description
A cross-site scripting (XSS) issue allows remote attackers to inject arbitrary web script or HTML via a
cms username cookie. This can lead to the execution of malicious code on the victim's browser.Recommendations
For Spitfire CMS version 1.0.436, update to a newer version that contains a fix for this issue, as using outdated versions poses a significant risk. As a temporary workaround, consider restricting access to the
cms username cookie to minimize the risk of exploitation.Exploit
Fix
XSS
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Spitfire Cms