PT-2022-10521 · Feehicms · Feehicms

Ghost · Published 2022-12-15 · Updated 2022-12-19 · CVE-2021-36572

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Feehi CMS versions 2.1.1 and earlier

Description The issue allows attackers to run arbitrary code via the user name field of the "/login" API endpoint. This is a Cross Site Scripting (XSS) issue, which means attackers can inject malicious scripts into the website, potentially leading to unauthorized access or control.

Recommendations For Feehi CMS versions 2.1.1 and earlier, as a temporary workaround, consider restricting access to the login page or validating and sanitizing the user name field to prevent malicious code injection. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2021-36572

GHSA-M54V-GV8P-9PQP

Affected Products

Feehicms

References · 6

• 🔥 https://github.com/liufee/cms/issues/58 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2021-36572 · Security Note
• https://osv.dev/vulnerability/CVE-2021-36572 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-m54v-gv8p-9pqp · Vendor Advisory
• https://github.com/liufee/cms · Note
• https://t.me/cvenotify/40179 · Telegram Post