PT-2019-6667 · Zikula · Zikula

Jan Lieskovsky · Published 2019-11-19 · Updated 2019-11-21 · CVE-2011-3352

Positive Technologies (AI Summary)

CVSS v2.0

3.5

Low

Base vector

AV:N/AC:M/Au:S/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Zikula versions prior to 1.3.0 build #3168

Description The issue is due to improper sanitization of the themename parameter, allowing a remote attacker with administrator privileges to execute arbitrary HTML or web script code in the context of the affected website by setting default, modifying, and deleting themes.

Recommendations For versions prior to 1.3.0 build #3168, avoid using the themename parameter in theme management until a fix is available. As a temporary workaround, consider restricting access to theme modification and deletion functionality to minimize the risk of exploitation.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2011-3352

Affected Products

Zikula

References · 4

• 🔥 https://immuniweb.com/advisory/HTB23039 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2011-3352 · Security Note
• https://access.redhat.com/security/cve/cve-2011-3352 · Note
• https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2011-3352 · Note