PT-2022-7933 · Unknown · Elefant Cms

Tim Coen · Published 2022-06-20 · Updated 2022-06-28 · CVE-2017-20060

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Elefant CMS version 1.3.12-RC

Description A problematic issue was found in the Blog Post Handler component, leading to basic cross site scripting (Persistent). The attack can be initiated remotely. Upgrading to version 1.3.13 addresses this issue.

Recommendations For Elefant CMS version 1.3.12-RC, upgrade to version 1.3.13 to resolve the issue.

Fix

XSS

Weakness Enumeration

CWE-80

CWE-79

Related Identifiers

CVE-2017-20060

GHSA-4453-G295-24MH

Affected Products

Elefant Cms

References · 7

• https://osv.dev/vulnerability/CVE-2017-20060 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-4453-g295-24mh · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2017-20060 · Security Note
• https://github.com/jbroadway/elefant · Note
• http://seclists.org/fulldisclosure/2017/Feb/36 · Note
• https://vuldb.com/?id.97257 · Note
• https://t.me/cibsecurity/44806 · Telegram Post