PT-2023-27142 · Mingsoft · Mingsoft Mcms

一剑还原 · Published 2023-07-28 · Updated 2024-05-17 · CVE-2023-3990

Positive Technologies (AI Summary)

CVSS v2.0

4.0

Medium

Base vector

AV:N/AC:L/Au:S/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Mingsoft MCMS versions up to 5.3.1

Description A problematic vulnerability has been found in Mingsoft MCMS, affecting an unknown part of the file search.do of the component HTTP POST Request Handler. The manipulation of the argument style leads to cross-site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.

Recommendations For Mingsoft MCMS versions up to 5.3.1, apply a patch to fix this issue. As a temporary workaround, consider restricting access to the search.do file or disabling the manipulation of the style argument in the HTTP POST Request Handler to minimize the risk of exploitation.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2023-3990

GHSA-RXVJ-5MV6-J5MC

Affected Products

Mingsoft Mcms

References · 8

• 🔥 https://gitee.com/mingSoft/MCMS/issues/I7K4DQ · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2023-3990 · Security Note
• https://osv.dev/vulnerability/GHSA-rxvj-5mv6-j5mc · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-3990 · Vendor Advisory
• https://github.com/ming-soft/MCMS · Note
• https://vuldb.com/?id.235611 · Note
• https://t.me/cibsecurity/67359 · Telegram Post
• https://vuldb.com/?ctiid.235611 · Note