PT-2022-24436 · Ucms · Ucms

Zoe0427 · Published 2022-09-19 · Updated 2022-09-22 · CVE-2022-38527

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions UCMS version 1.6.0

Description A cross-site scripting (XSS) issue was found in UCMS via the Import function under the Site Management page. This allows for potential malicious script execution.

Recommendations For UCMS version 1.6.0, consider disabling the Import function under the Site Management page as a temporary workaround until a patch is available. Restrict access to the Site Management page to minimize the risk of exploitation. Avoid using the Import function until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2022-38527

Affected Products

Ucms

References · 5

• 🔥 https://github.com/Zoe0427/UCMS-v1.6/blob/gh-pages/UCMS_v1.6.0%20XSS.md · Exploit
• https://osv.dev/vulnerability/CVE-2022-38527 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-38527 · Security Note
• https://t.me/cibsecurity/50111 · Telegram Post
• https://t.me/cvenotify/36471 · Telegram Post