PT-2020-17261 · Typesetter · Typesetter Cms

Published 2020-12-11 · Updated 2024-08-04 · CVE-2020-35126

Positive Technologies (AI Summary)

CVSS v3.1

4.8

Medium

Base vector

AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Typesetter CMS versions 5.x through 5.1

Description The issue allows admins to conduct Site Title persistent XSS attacks via an Admin/Configuration URI. The significance of this report is disputed because admins are considered trustworthy.

Recommendations For versions 5.x through 5.1, as a temporary workaround, consider restricting access to the Admin/Configuration URI to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2020-35126

Affected Products

Typesetter Cms

References · 14

• https://nvd.nist.gov/vuln/detail/CVE-2020-35126 · Security Note
• https://osv.dev/vulnerability/CVE-2020-35126 · Vendor Advisory
• https://t.me/cibsecurity/19928 · Telegram Post
• https://t.me/cibsecurity/19908 · Telegram Post
• https://t.me/cvenotify/89036 · Telegram Post
• https://t.me/cibsecurity/19869 · Telegram Post
• https://t.me/cibsecurity/19809 · Telegram Post
• https://t.me/cibsecurity/19769 · Telegram Post
• https://exploit-db.com/exploits/48852 · Note
• https://t.me/cibsecurity/19829 · Telegram Post
• https://t.me/cibsecurity/19948 · Telegram Post
• https://t.me/cibsecurity/19889 · Telegram Post
• https://t.me/cibsecurity/19849 · Telegram Post
• https://t.me/cibsecurity/19789 · Telegram Post