PT-2020-17117 · Lepton · Leptoncms

Sagar Banwa · Published 2020-12-02 · Updated 2020-12-02 · CVE-2020-29240

Positive Technologies (AI Summary)

CVSS v3.1

4.8

Medium

Base vector

AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Lepton-CMS version 4.7.0

Description The issue is related to cross-site scripting (XSS), where an attacker can inject an XSS payload in the URL field of the admin page. This XSS will be triggered each time an admin visits the Menu-Pages-Pages Overview section.

Recommendations For Lepton-CMS version 4.7.0, as a temporary workaround, consider restricting access to the admin page and the Menu-Pages-Pages Overview section to minimize the risk of exploitation. Avoid using the URL field in the admin page until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this issue.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2020-29240

Affected Products

Leptoncms

References · 6

• 🔥 https://exploit-db.com/exploits/49137 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2020-29240 · Security Note
• https://osv.dev/vulnerability/CVE-2020-29240 · Vendor Advisory
• https://lepton-cms.org/english/home.php · Vendor Advisory
• https://t.me/cibsecurity/17049 · Telegram Post
• https://t.me/cvenotify/6462 · Telegram Post