CVE-2015-8376

Name of the Vulnerable Software and Affected Versions Symphony CMS version 2.6.3

Description The issue concerns multiple cross-site scripting (XSS) vulnerabilities. These vulnerabilities allow remote attackers to inject arbitrary web script or HTML. The vulnerable parameters include the Name, Navigation Group, and Label parameters to the "blueprints/sections/edit/1" endpoint.

Recommendations For Symphony CMS version 2.6.3, update to a version that includes a fix for this issue. As a temporary workaround, consider restricting input for the Name, Navigation Group, and Label parameters to prevent arbitrary web script or HTML injection until a patch is available.