PT-2021-17600 · Unknown · Batflat Cms

Tadjmeno · Published 2021-03-11 · Updated 2021-03-12 · CVE-2021-27677

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Batflat CMS version 1.3.6

Description The issue allows remote attackers to inject arbitrary web script or HTML via the field name variable, potentially leading to cross-site scripting (XSS) attacks. This could enable attackers to execute malicious scripts on the victim's browser.

Recommendations For Batflat CMS version 1.3.6, update to a version that fixes the XSS vulnerability in Galleries, ensuring that user input in the field name is properly sanitized to prevent code injection. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2021-27677

Affected Products

Batflat Cms

References · 4

• 🔥 https://github.com/sruupl/batflat/issues/105 · Exploit
• https://osv.dev/vulnerability/CVE-2021-27677 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-27677 · Security Note
• https://t.me/cibsecurity/24799 · Telegram Post