PT-2022-11516 · Unknown · Zenario Cms

Hieuminhnv · Published 2022-03-14 · Updated 2022-03-21 · CVE-2021-41952

Positive Technologies (AI Summary)

CVSS v3.1

4.8

Medium

Base vector

AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Zenario CMS version 9.0.54156

Description The issue allows for Cross Site Scripting (XSS) via the upload of malicious files with an *.SVG extension. An attacker can exploit this by sending these malicious files to victims, potentially stealing their cookies and leading to account takeover. The person viewing the image of a contact can be a victim of XSS.

Recommendations For Zenario CMS version 9.0.54156, consider disabling the upload of *.SVG files until a patch is available to prevent the exploitation of this issue. Restrict access to the image viewing feature for contacts to minimize the risk of exploitation. Avoid using the feature that allows the upload of files, especially *.SVG files, in the affected API endpoint until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2021-41952

GHSA-X8WJ-CQMP-3WMM

Affected Products

Zenario Cms

References · 8

• 🔥 https://github.com/hieuminhnv/Zenario-CMS-9.0-last-version/issues/1 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2021-41952 · Security Note
• https://osv.dev/vulnerability/CVE-2021-41952 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-x8wj-cqmp-3wmm · Vendor Advisory
• https://github.com/TribalSystems/Zenario/releases/tag/9.0.55141 · Note
• https://github.com/TribalSystems/Zenario/commit/4566d8a9ac6755f098b3373252fdb17754a77007 · Note
• https://github.com/TribalSystems/Zenario · Note
• https://t.me/cibsecurity/38878 · Telegram Post