PT-2021-10481 · Wtcms · Wtcms

Ch3Ng-Sky · Published 2021-09-01 · Updated 2021-09-07 · CVE-2020-20345

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions: WTCMS version 1.0

Description: The issue is related to a reflective cross-site scripting (XSS) vulnerability in the page management background. This vulnerability allows attackers to obtain cookies via a crafted payload entered into the search box.

Recommendations: For WTCMS version 1.0, as a temporary workaround, consider restricting access to the page management background to minimize the risk of exploitation. Avoid using the search box in the page management background until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2020-20345

Affected Products

Wtcms

References · 6

• 🔥 https://github.com/taosir/wtcms/issues/10 · Exploit
• https://osv.dev/vulnerability/CVE-2020-20345 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-20345 · Security Note
• https://github.com/taosir/wtcms · Note
• http://wtcms.com · Note
• https://t.me/cvenotify/20540 · Telegram Post