PT-2018-10629 · Creatiwity · Creatiwity Witycms

Nathu Nandwani · Published 2018-05-28 · Updated 2018-06-29 · CVE-2018-11512

Positive Technologies (AI Summary)

CVSS v3.1

4.8

Medium

Base vector

AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Creatiwity wityCMS version 0.6.1

Description A stored cross-site scripting (XSS) issue exists in the 'Website's name' field of the 'Settings' page under the 'General' menu. This allows remote attackers to inject arbitrary web script or HTML via a crafted website name by sending an authenticated POST HTTP request to the "admin/settings/general" endpoint.

Recommendations For Creatiwity wityCMS version 0.6.1, as a temporary workaround, consider validating and sanitizing user input for the website name variable to prevent XSS attacks. Restrict access to the 'Settings' page under the 'General' menu to minimize the risk of exploitation.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2018-11512

Affected Products

Creatiwity Witycms

References · 5

• 🔥 https://github.com/Creatiwity/wityCMS/issues/150 · Exploit
• 🔥 https://exploit-db.com/exploits/44790 · Exploit
• https://github.com/Creatiwity/wityCMS/commit/7967e5bf15b4d2ee6b85b56e82d7e1229147de44 · Patch
• https://osv.dev/vulnerability/CVE-2018-11512 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2018-11512 · Security Note