PT-2018-10629
CVE-2018-11512
·
تاريخ النشر
2018-05-28
·
تاريخ التحديث
2018-06-29
الوصف من
CVSS 3.1
4.8
متوسطةالمقاييسAV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
Name of the Vulnerable Software and Affected Versions
Creatiwity wityCMS version 0.6.1
Description
A stored cross-site scripting (XSS) issue exists in the 'Website's name' field of the 'Settings' page under the 'General' menu. This allows remote attackers to inject arbitrary web script or HTML via a crafted website name by sending an authenticated POST HTTP request to the "admin/settings/general" endpoint.
Recommendations
For Creatiwity wityCMS version 0.6.1, as a temporary workaround, consider validating and sanitizing user input for the
website name variable to prevent XSS attacks. Restrict access to the 'Settings' page under the 'General' menu to minimize the risk of exploitation.قابلية الاستغلال
استغلال
إصلاح
التأثيرات
الباحثون
المورّدون
المنتجات المتأثرة
وجدت خطأً في الوصف؟ لديك ما تضيفه؟ لا تتردد في مراسلتنا 👾