PT-2022-23480 · Unknown · Pagekit Cms

Breakalegcml · Published 2022-08-28 · Updated 2022-09-01 · CVE-2022-36573

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Pagekit CMS version 1.0.18

Description A cross-site scripting (XSS) issue allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Markdown text box under the "/blog/post/edit" API endpoint. The Markdown text box is the vulnerable parameter.

Recommendations For Pagekit CMS version 1.0.18, consider disabling the Markdown text box under the "/blog/post/edit" API endpoint until a patch is available. Restrict access to this endpoint to minimize the risk of exploitation. Avoid using the Markdown text box in the affected API endpoint until the issue is resolved.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2022-36573

GHSA-Q6H8-QJJC-J8CG

Affected Products

Pagekit Cms

References · 8

• 🔥 https://github.com/pagekit/pagekit/issues/968 · Exploit
• https://osv.dev/vulnerability/CVE-2022-36573 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-36573 · Security Note
• https://osv.dev/vulnerability/GHSA-q6h8-qjjc-j8cg · Vendor Advisory
• https://github.com/pagekit/pagekit · Note
• https://t.me/cibsecurity/48949 · Telegram Post
• https://t.me/cvenotify/35286 · Telegram Post
• https://t.me/cvenotify/35577 · Telegram Post