PT-2021-10862 · Unknown · Lavalite Cms

Luuthehienhbit · Published 2021-07-26 · Updated 2021-08-09 · CVE-2020-23234

Positive Technologies (AI Summary)

CVSS v3.1

4.8

Medium

Base vector

AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions LavaLite CMS version 5.8.0

Description A Cross Site Scripting (XSS) issue exists in the Menu Blocks feature of LavaLite CMS, which can be bypassed by using HTML event handlers, such as ontoggle. This allows for potential malicious script execution.

Recommendations For LavaLite CMS version 5.8.0, consider disabling the Menu Blocks feature until a patch is available to prevent exploitation of the XSS issue. Restrict access to the Menu Blocks feature to minimize the risk of malicious script execution. Avoid using HTML event handlers, such as ontoggle, in the Menu Blocks feature until the issue is resolved.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2020-23234

GHSA-V2F3-F8X4-M3W8

Affected Products

Lavalite Cms

References · 6

• 🔥 https://github.com/LavaLite/cms/issues/320 · Exploit
• https://osv.dev/vulnerability/CVE-2020-23234 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-23234 · Security Note
• https://osv.dev/vulnerability/GHSA-v2f3-f8x4-m3w8 · Vendor Advisory
• https://t.me/cibsecurity/26532 · Telegram Post
• https://t.me/cvenotify/18166 · Telegram Post