PT-2023-12288 · Tpcms · Tpcms

Xrun · Published 2023-02-03 · Updated 2023-02-09 · CVE-2021-36545

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions tpcms version 3.2

Description A Cross Site Scripting (XSS) issue allows remote attackers to run arbitrary code via the cfg copyright or cfg tel field in the Site Configuration page. This enables attackers to execute malicious scripts on the website.

Recommendations For tpcms version 3.2, as a temporary workaround, consider restricting access to the Site Configuration page until a patch is available. Avoid using the cfg copyright and cfg tel fields in the Site Configuration page until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2021-36545

Affected Products

Tpcms

References · 4

• 🔥 https://gitee.com/happy_source/tpcms/issues/I3YUCJ · Exploit
• https://osv.dev/vulnerability/CVE-2021-36545 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-36545 · Security Note
• https://t.me/cibsecurity/57493 · Telegram Post