PT-2021-24304 · Unknown · Glfusion Cms

Published 2021-12-27 · Updated 2022-09-30 · CVE-2021-45843

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions: glFusion CMS version 1.7.9

Description: The issue concerns a reflected Cross Site Scripting (XSS) vulnerability. Specifically, the value of the title request parameter is copied into an HTML tag attribute encapsulated in double quotation marks and echoed unmodified in the application's response. This allows for potential malicious script injection.

Recommendations: For glFusion CMS version 1.7.9, as a temporary workaround, consider validating and sanitizing the title request parameter to prevent XSS attacks. Ensure that any user-input data is properly encoded before being reflected in the application's response. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2021-45843

Affected Products

Glfusion Cms

References · 4

• 🔥 https://github.com/nu11secur1ty/CVE-nu11secur1ty/tree/main/vendors/glfusion/XSS-Reflected · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2021-45843 · Security Note
• https://osv.dev/vulnerability/CVE-2021-45843 · Vendor Advisory
• https://t.me/cibsecurity/50679 · Telegram Post