PT-2021-10298 · S Cms · S-Cms

Published 2021-09-15 · Updated 2021-09-22 · CVE-2020-19158

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions: S-CMS versions 20191014 and earlier

Description: The issue allows remote attackers to execute arbitrary code via the Site Title parameter of the component "/data/admin/#/app/config/". This enables attackers to perform Cross Site Scripting (XSS) attacks.

Recommendations: For S-CMS versions 20191014 and earlier, as a temporary workaround, consider restricting access to the "/data/admin/#/app/config/" component to minimize the risk of exploitation. Avoid using the Site Title parameter in the affected component until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this issue.

Fix

RCE

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2020-19158

Affected Products

S-Cms

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2020-19158 · Security Note
• https://osv.dev/vulnerability/CVE-2020-19158 · Vendor Advisory
• https://t.me/cibsecurity/28908 · Telegram Post
• ❌ https://github.com/TL-swallow/swallow/blob/master/S-CMS%20XSS1.docx · Note, Deleted
• https://t.me/cvenotify/20896 · Telegram Post