PT-2021-16898 · Publify · Publify

Published 2021-11-10 · Updated 2024-03-06 · CVE-2021-25974

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Publify versions v8.0 through v9.2.4

Description The issue allows a user with a publisher role to inject and execute arbitrary JavaScript code, enabling stored XSS attacks. This can occur while creating a page or article, potentially through unrestricted file upload, which permits malicious JavaScript injection via uploaded HTML files.

Recommendations For Publify versions v8.0 through v9.2.4, consider restricting file uploads or validating the content of uploaded files to prevent malicious code execution until a patch is available. As a temporary workaround, limiting the privileges of the publisher role may help minimize the risk of exploitation.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

BIT-PUBLIFY-2021-25974

BIT-PUBLIFY-2021-25975

CVE-2021-25974

GHSA-3H7V-WQW7-FF28

GHSA-WMH9-X28J-C6GR

Affected Products

Publify

References · 12

• https://github.com/publify/publify/commit/fefd5f76302adcc425b2b6e7e7d23587cfc0083e · Patch
• https://osv.dev/vulnerability/CVE-2021-25974 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-25974 · Security Note
• https://osv.dev/vulnerability/BIT-publify-2021-25975 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-wmh9-x28j-c6gr · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-25975 · Security Note
• https://osv.dev/vulnerability/BIT-publify-2021-25974 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-3h7v-wqw7-ff28 · Vendor Advisory
• https://github.com/publify/publify/commit/d99c0870d3dbbfde7febdc6cad33199b84770101 · Note
• https://github.com/publify/publify · Note
• https://t.me/cibsecurity/32148 · Telegram Post
• https://whitesourcesoftware.com/vulnerability-database/CVE-2021-25974 · Note