PT-2020-20402 · Tiki · Tiki Wiki Cms

The Csirt · Published 2020-04-01 · Updated 2020-04-03 · CVE-2020-8966

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Tiki-Wiki CMS versions through 20.0

Description The issue is related to an Improper Neutralization of Script-Related HTML Tags in a Web Page, also known as Basic XSS. This allows malicious users to inject malicious code fragments, such as scripts, into a legitimate web page.

Recommendations For versions through 20.0, update to a version that contains a fix for this issue to prevent malicious code injection. As a temporary workaround, consider restricting user input to prevent the injection of malicious scripts until a patch is available.

Fix

XSS

Weakness Enumeration

CWE-80

CWE-79

Related Identifiers

CVE-2020-8966

Affected Products

Tiki Wiki Cms

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2020-8966 · Security Note
• https://sourceforge.net/p/tikiwiki/code/75455 · Patch
• https://osv.dev/vulnerability/CVE-2020-8966 · Vendor Advisory
• https://incibe-cert.es/en/early-warning/security-advisories/cross-site-scripting-xss-flaws-found-tiki-wiki-cms-software · Note
• https://t.me/cvenotify/2351 · Telegram Post