PT-2021-12051 · Unknown · Cms Made Simple

Songohan · Published 2021-07-02 · Updated 2021-07-06 · CVE-2020-36413

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions: CMS Made Simple version 2.2.14

Description: A stored cross-site scripting (XSS) issue allows authenticated attackers to execute arbitrary web scripts or HTML by entering a crafted payload into the Exclude these IP addresses from the "Site Down" status parameter under the Maintenance Mode module.

Recommendations: For CMS Made Simple version 2.2.14, as a temporary workaround, consider restricting access to the Maintenance Mode module until a patch is available. Avoid using the Exclude these IP addresses from the "Site Down" status parameter in the affected module until the issue is resolved.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2020-36413

Affected Products

Cms Made Simple

References · 3

• 🔥 http://dev.cmsmadesimple.org/bug/view/12325 · Exploit
• https://osv.dev/vulnerability/CVE-2020-36413 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-36413 · Security Note