PT-2021-10890
CVE-2020-23369
·
Published
2021-05-10
·
Updated
2021-05-13
Description by
CVSS 3.1
6.1
MediumMetricsAV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Name of the Vulnerable Software and Affected Versions
YzmCMS version 5.6
Description
A cross-site scripting (XSS) issue was found in the member/member content/init.html file due to the use of UEditor 1.4.3.3, specifically via the SRC attribute of an IFRAME element.
Recommendations
For YzmCMS version 5.6, consider updating or replacing UEditor to a version that fixes the XSS issue, or temporarily restrict the use of the SRC attribute in IFRAME elements within the member/member content/init.html file to minimize the risk of exploitation.
Exploitability
Exploit
Fix
Impacts
Researchers
Vendors
Affected products
Found an issue in the description? Have something to add? Feel free to write us 👾