PT-2021-23216 · Kirby · Kirby

Azrul Ikhwan Zulkifli + 1 · Published 2021-11-16 · Updated 2021-11-18 · CVE-2021-41252

Positive Technologies (AI Summary)

CVSS v3.1

7.3

High

Base vector

AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions Kirby versions prior to 3.5.8

Description The issue concerns the writer field in Kirby, which stores formatted content as HTML code and does not escape HTML special characters against cross-site scripting (XSS) attacks. This allows malicious HTML code to be injected into the content file and executed in the browsers of site visitors and logged-in users. The vulnerability can be exploited by attackers who are in the group of authenticated Panel users, potentially leading to escalated privileges if they gain access to an admin user's Panel session. The estimated number of potentially affected devices is not specified.

Recommendations For versions prior to 3.5.8, update to Kirby 3.5.8 or a later version to fix the vulnerability. As a temporary workaround, consider restricting access to the writer field for authenticated Panel users to minimize the risk of exploitation. If possible, avoid using the writer field until the issue is resolved.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2021-41252

GHSA-X7J7-QP7J-HW3Q

Affected Products

Kirby

References · 7

• https://github.com/getkirby/kirby/commit/25fc5c6b330442e6433c99befc688f3698c5d1fc · Patch
• https://osv.dev/vulnerability/CVE-2021-41252 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-41252 · Security Note
• https://osv.dev/vulnerability/GHSA-x7j7-qp7j-hw3q · Vendor Advisory
• https://github.com/getkirby/kirby · Note
• https://github.com/getkirby/kirby/security/advisories/GHSA-x7j7-qp7j-hw3q · Note
• https://github.com/getkirby/kirby/releases/tag/3.5.8 · Note