PT-2023-26681 · Csz Cms+2 · Csz Cms+3

Desencrypt · Published 2023-08-18 · Updated 2023-08-22 · CVE-2023-38910

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions CSZ CMS version 1.3.0

Description The issue allows attackers to execute arbitrary web scripts or HTML via a crafted payload entered in the 'Carousel Wiget' section and choosing the carousel widget created above, in 'Photo URL' and 'YouTube URL' plugin. This enables cross-site scripting (XSS) attacks.

Recommendations For CSZ CMS version 1.3.0, as a temporary workaround, consider disabling the 'Carousel Wiget' section and the 'Photo URL' and 'YouTube URL' plugins until a patch is available. Restrict access to these plugins to minimize the risk of exploitation. Avoid using the 'Photo URL' and 'YouTube URL' fields in the 'Carousel Wiget' section until the issue is resolved.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2023-38910

Affected Products

Csz Cms

Carousel Wiget

Photo Url

Youtube Url

References · 6

• 🔥 https://github.com/desencrypt/CVE/blob/main/CVE-2023-38910/Readme.md · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2023-38910 · Security Note
• https://osv.dev/vulnerability/CVE-2023-38910 · Vendor Advisory
• https://t.me/cvenotify/56861 · Telegram Post
• https://t.me/cvenotify/56891 · Telegram Post
• https://t.me/cibsecurity/68843 · Telegram Post