PT-2024-40365 · Cms · Cms

Published 2024-05-23 · Updated 2024-05-23

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions No specific software or versions mentioned, so: CMS (affected versions not specified)

Description The issue is due to a lack of parameter sanitisation, allowing a carefully crafted URL to inject arbitrary HTML into the CMS Edit page. An attacker could create and share such a URL with a site administrator to perform an attack.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

XSS

Weakness Enumeration

CWE-79

Related Identifiers

GHSA-M8V7-X398-PXRF

Affected Products

Cms

References · 6

• https://osv.dev/vulnerability/GHSA-m8v7-x398-pxrf · Vendor Advisory
• https://github.com/FriendsOfPHP/security-advisories/blob/master/silverstripe/framework/SS-2016-004-1.yaml · Note
• https://github.com/silverstripe/silverstripe-framework/commits/3.3.2 · Note
• https://github.com/silverstripe/silverstripe-framework/commit/a24c8260b1d048dc6a0836eb1be9a1ca2056e770 · Note
• https://github.com/silverstripe/silverstripe-framework · Note
• https://silverstripe.org/download/security-releases/ss-2016-004 · Note