CVE-2020-19007

Name of the Vulnerable Software and Affected Versions Halo blog version 1.2.0

Description The issue allows attackers to submit comments on blog posts via the "/api/content/posts/comments" API endpoint. The JavaScript code supplied by the attacker will then execute in the victim user's browser.

Recommendations For version 1.2.0, consider disabling the comment submission feature via the "/api/content/posts/comments" API endpoint until a patch is available. Restrict access to this endpoint to minimize the risk of exploitation.