PT-2018-13847 · Monstra · Monstra Cms

Princyedwardo · Published 2018-09-13 · Updated 2018-10-30 · CVE-2018-17026

Positive Technologies (AI Summary)

CVSS v3.1

4.8

Medium

Base vector

AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Monstra CMS version 3.0.4

Description The issue concerns an XSS vulnerability. It can be exploited via the page meta title parameter in an "edit page&name=error404" action on the "admin/index.php" page.

Recommendations For Monstra CMS version 3.0.4, avoid using the page meta title parameter in the "edit page&name=error404" action on the "admin/index.php" page until the issue is resolved.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2018-17026

Affected Products

Monstra Cms

References · 3

• 🔥 https://github.com/bg5sbk/MiniCMS/issues/25 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2018-17026 · Security Note
• https://osv.dev/vulnerability/CVE-2018-17026 · Vendor Advisory