PT-2023-20325 · Strikingly · Strikingly Cms

Rémy Marot · Published 2023-05-08 · Updated 2025-01-28 · CVE-2023-2582

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Strikingly CMS (affected versions not specified)

Description A prototype pollution issue exists in Strikingly CMS, potentially leading to reflected cross-site scripting (XSS) in affected applications and sites. This occurs because the Strikingly JavaScript library's parsing of the URL fragment allows access to the proto or constructor properties and the Object prototype. An attacker could exploit this by convincing a victim to visit a specially crafted link, leveraging an embedded gadget like jQuery to achieve arbitrary JavaScript execution in the context of the user's browser.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Prototype Pollution

Weakness Enumeration

CWE-1321

Related Identifiers

CVE-2023-2582

Affected Products

Strikingly Cms

References · 4

• 🔥 https://tenable.com/security/research/tra-2023-18 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2023-2582 · Security Note
• https://t.me/cvenotify/50006 · Telegram Post
• https://t.me/cvenotify/108924 · Telegram Post