PT-2022-18229 · Jfinalcms · Jfinalcms

Published 2022-04-11 · Updated 2022-04-15 · CVE-2022-27111

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Jfinal CMS version 5.1.0

Description The issue allows attackers to use the feedback function to send malicious XSS code to the administrator backend and execute it. This can potentially lead to unauthorized access or control of the administrator backend.

Recommendations For Jfinal CMS version 5.1.0, consider disabling the feedback function until a patch is available to prevent the execution of malicious XSS code. Restrict access to the administrator backend to minimize the risk of exploitation.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2022-27111

Affected Products

Jfinalcms

References · 5

• 🔥 https://github.com/jflyfox/jfinal_cms/issues/32 · Exploit
• https://osv.dev/vulnerability/CVE-2022-27111 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-27111 · Security Note
• https://t.me/cvenotify/28706 · Telegram Post
• https://t.me/cibsecurity/40482 · Telegram Post