PT-2020-17297 · Fluxbb · Fluxbb

Miovisman · Published 2020-12-30 · Updated 2022-04-22 · CVE-2020-35240

Positive Technologies (AI Summary)

CVSS v3.1

4.8

Medium

Base vector

AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions FluxBB version 1.5.11

Description The issue allows an attacker to inject a cross-site scripting (XSS) payload in the "Blog Content" component. When any user visits the blog, the XSS triggers, enabling the attacker to steal cookies based on the crafted payload.

Recommendations For FluxBB version 1.5.11, consider disabling the "Blog Content" component until a patch is available to prevent the injection of XSS payloads. Restrict access to this component to minimize the risk of exploitation. Avoid using the "Blog Content" feature in a way that could allow an attacker to inject malicious scripts. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2020-35240

Affected Products

Fluxbb

References · 7

• 🔥 https://github.com/hemantsolo/CVE-Reference/blob/main/CVE-2020-35240.md · Exploit
• 🔥 https://github.com/hemantsolo/CVE-Reference/issues/1 · Exploit
• https://osv.dev/vulnerability/CVE-2020-35240 · Vendor Advisory
• https://fluxbb.org/downloads · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-35240 · Security Note
• https://t.me/cvenotify/8158 · Telegram Post
• https://t.me/cvenotify/17961 · Telegram Post