PT-2021-7902 · Cksource · Ckeditor

Published 2021-10-22 · Updated 2021-10-28 · CVE-2020-23044

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions DedeCMS version 7.5 SP2

Description The issue is related to the lack of protection measures for the web page structure in the file pic view.php component of the DedeCMS content management system. This can be exploited by a remote attacker to conduct cross-site scripting (XSS) attacks. The vulnerability is specifically found in the activepath, keyword, tag, fmdo=x&filename, CKEditor, and CKEditorFuncNum parameters.

Recommendations For DedeCMS version 7.5 SP2, consider disabling the file pic view.php component until a patch is available to prevent exploitation of the XSS vulnerability via the activepath, keyword, tag, fmdo=x&filename, CKEditor, and CKEditorFuncNum parameters. Restrict access to these parameters in the component to minimize the risk of XSS attacks. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

XSS

Weakness Enumeration

CWE-79

Related Identifiers

BDU:2023-05260

CVE-2020-23044

Affected Products

Ckeditor

References · 5

• 🔥 https://vulnerability-lab.com/get_content.php?id=2195 · Exploit
• https://bdu.fstec.ru/vul/2023-05260 · Security Note
• https://osv.dev/vulnerability/CVE-2020-23044 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-23044 · Security Note
• https://t.me/cvenotify/22538 · Telegram Post