PT-2022-12262 · Xe · Xe

Cyc1E183 · Published 2022-02-09 · Updated 2022-02-16 · CVE-2021-44911

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions XE versions prior to 1.11.6

Description The issue allows for unrestricted file upload via the modules/menu/menu.admin.controller.php module. When uploading the Mouse over button and the When selected button, there is no restriction on the file suffix, which leads to any file being uploaded to the files directory. Since .htaccess only restricts the PHP type, uploading HTML-type files leads to stored XSS vulnerabilities.

Recommendations For versions prior to 1.11.6, update to version 1.11.6 or later to resolve the issue. As a temporary workaround, consider restricting access to the modules/menu/menu.admin.controller.php module until a patch is available. Avoid using the file upload feature in the Mouse over button and the When selected button until the issue is resolved.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2021-44911

Affected Products

Xe

References · 4

• 🔥 https://github.com/xpressengine/xe-core/issues/2434 · Exploit
• https://osv.dev/vulnerability/CVE-2021-44911 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-44911 · Security Note
• https://t.me/cvenotify/26521 · Telegram Post