PT-2022-12562 · Jfinalcms · Jfinalcms

Al1Exo · Published 2022-01-25 · Updated 2022-01-28 · CVE-2021-46087

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions jfinal cms versions 5.1.0 and later

Description The issue is related to a storage XSS vulnerability in the background system of the CMS. This occurs because the developers do not filter the parameters submitted by the user input form, allowing any user with background permission to affect the system security by entering malicious code.

Recommendations For jfinal cms versions 5.1.0 and later, consider filtering parameters submitted by the user input form to prevent malicious code entry. As a temporary workaround, restrict background permission to trusted users until a proper fix is implemented.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2021-46087

Affected Products

Jfinalcms

References · 4

• 🔥 https://github.com/jflyfox/jfinal_cms/issues/19 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2021-46087 · Security Note
• https://osv.dev/vulnerability/CVE-2021-46087 · Vendor Advisory
• https://t.me/cibsecurity/36236 · Telegram Post