PT-2021-3511 · Sulu · Sulu

Alexander-Schranz · Published 2021-07-02 · Updated 2021-07-09 · CVE-2021-32737

Positive Technologies (AI Summary)

CVSS v3.1

8.4

High

Base vector

AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Sulu versions prior to 1.6.41

Description The issue is related to the lack of protection of the web page structure in the Sulu content management system, allowing a remote attacker to conduct cross-site scripting attacks. A logged-in admin user can add a script injection in the collection title, which can be executed. The problem is patched in version 1.6.41.

Recommendations For versions prior to 1.6.41, update to version 1.6.41 to resolve the issue. As a temporary workaround, manually patch the affected JavaScript files.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

BDU:2021-03560

CVE-2021-32737

GHSA-GM2X-6475-G9R8

Affected Products

Sulu

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2021-32737 · Security Note
• https://osv.dev/vulnerability/GHSA-gm2x-6475-g9r8 · Vendor Advisory
• https://bdu.fstec.ru/vul/2021-03560 · Security Note
• https://osv.dev/vulnerability/CVE-2021-32737 · Vendor Advisory
• https://github.com/sulu/sulu/releases/tag/1.6.41 · Note
• https://github.com/sulu/sulu/security/advisories/GHSA-gm2x-6475-g9r8 · Note
• https://t.me/cibsecurity/25904 · Telegram Post
• https://t.me/cvenotify/17338 · Telegram Post