PT-2021-10624 · Maccms · Maccms

Published 2021-10-04 · Updated 2021-10-07 · CVE-2020-21434

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions: Maccms version 10

Description: The issue is related to a cross-site scripting (XSS) vulnerability in the Editing function under the Member module. This vulnerability can be exploited via a crafted payload in the nickname text field.

Recommendations: For Maccms version 10, consider restricting input in the nickname text field to prevent the injection of malicious scripts until a fix is available. As a temporary workaround, disabling the Editing function under the Member module can help minimize the risk of exploitation.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2020-21434

Affected Products

Maccms

References · 4

• 🔥 https://github.com/Ksharp12138/maccms_userinfo_xss/blob/master/maccms_xss.md · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2020-21434 · Security Note
• https://osv.dev/vulnerability/CVE-2020-21434 · Vendor Advisory
• https://t.me/cibsecurity/29940 · Telegram Post