PT-2022-7932

CVE-2017-20059

Published

2022-06-20

Updated

2022-06-28

Description by

CVSS 3.1

5.4

Medium

MetricsAV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Elefant CMS version 1.3.12-RC

Description A problematic issue has been found in the Title Handler component of Elefant CMS, allowing for basic cross site scripting (Persistent) through the manipulation of input, such as </title><img src=no onerror=alert(1)>. This issue can be exploited remotely.

Recommendations For Elefant CMS version 1.3.12-RC, upgrade to version 1.3.13 to address this issue.

Exploitability

Fix

Impacts

Researchers

Vendors

Affected products

Weakness enumeration

CWE-80: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)

CWE-79: Improper Neutralization of Input During Web Page Generation (\'Cross-site Scripting\')

Related identifiers

CVE-2017-20059