Multiple XSS vulnerabilities in Croogo
Security Bulletin
This security bulletin contains information about 18 vulnerabilities.
1) Stored cross-site scripting
EUVDB-ID: #VU23068
Risk: Low
CVSSv4.0: 0.5 [CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:U/U:Clear]
CVE-ID: N/A
CWE-ID:
CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Exploit availability: No
DescriptionThe disclosed vulnerability allows a remote attacker to perform cross-site scripting (XSS) attacks.
The vulnerability exists due to insufficient sanitization of user-supplied data passed via settings in "/Settings/src/Template/Admin/Settings/form.ctp" script. A remote attacker can execute arbitrary HTML and script code in user's browser in context of vulnerable website.
Successful exploitation of this vulnerability may allow a remote attacker to steal potentially sensitive information, change appearance of the web page, perform phishing and drive-by-download attacks.
MitigationInstall updates from vendor's website.
Vulnerable software versionsCroogo: 3.0.0 - 3.0.6
CPE2.3- cpe:2.3:a:croogo:croogo:3.0.0:*:*:*:*:*:*:*
- cpe:2.3:a:croogo:croogo:3.0.0:alpha.1:*:*:*:*:*:*
- cpe:2.3:a:croogo:croogo:3.0.0:alpha.2:*:*:*:*:*:*
https://github.com/croogo/croogo/releases/tag/3.0.7
https://github.com/croogo/croogo/commit/cafaaabe2cef3d1d83652370e30563e6ad7c4158
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
2) Stored cross-site scripting
EUVDB-ID: #VU23067
Risk: Low
CVSSv4.0: 0.5 [CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:U/U:Clear]
CVE-ID: N/A
CWE-ID:
CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Exploit availability: No
DescriptionThe disclosed vulnerability allows a remote attacker to perform cross-site scripting (XSS) attacks.
The vulnerability exists due to insufficient sanitization of user-supplied data passed via field title in "/Nodes/src/Template/Nodes/view.ctp" script. A remote attacker can execute arbitrary HTML and script code in user's browser in context of vulnerable website.
Successful exploitation of this vulnerability may allow a remote attacker to steal potentially sensitive information, change appearance of the web page, perform phishing and drive-by-download attacks.
MitigationInstall updates from vendor's website.
Vulnerable software versionsCroogo: 3.0.0 - 3.0.6
CPE2.3- cpe:2.3:a:croogo:croogo:3.0.0:*:*:*:*:*:*:*
- cpe:2.3:a:croogo:croogo:3.0.0:alpha.1:*:*:*:*:*:*
- cpe:2.3:a:croogo:croogo:3.0.0:alpha.2:*:*:*:*:*:*
https://github.com/croogo/croogo/releases/tag/3.0.7
https://github.com/croogo/croogo/commit/cafaaabe2cef3d1d83652370e30563e6ad7c4158
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
3) Stored cross-site scripting
EUVDB-ID: #VU23066
Risk: Low
CVSSv4.0: 0.5 [CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:U/U:Clear]
CVE-ID: N/A
CWE-ID:
CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Exploit availability: No
DescriptionThe disclosed vulnerability allows a remote attacker to perform cross-site scripting (XSS) attacks.
The vulnerability exists due to insufficient sanitization of user-supplied data passed via title in "/Nodes/src/Template/Admin/Nodes/form.ctp" script. A remote attacker can execute arbitrary HTML and script code in user's browser in context of vulnerable website.
Successful exploitation of this vulnerability may allow a remote attacker to steal potentially sensitive information, change appearance of the web page, perform phishing and drive-by-download attacks.
MitigationInstall updates from vendor's website.
Vulnerable software versionsCroogo: 3.0.0 - 3.0.6
CPE2.3- cpe:2.3:a:croogo:croogo:3.0.0:*:*:*:*:*:*:*
- cpe:2.3:a:croogo:croogo:3.0.0:alpha.1:*:*:*:*:*:*
- cpe:2.3:a:croogo:croogo:3.0.0:alpha.2:*:*:*:*:*:*
https://github.com/croogo/croogo/releases/tag/3.0.7
https://github.com/croogo/croogo/commit/cafaaabe2cef3d1d83652370e30563e6ad7c4158
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
4) Stored cross-site scripting
EUVDB-ID: #VU23065
Risk: Low
CVSSv4.0: 0.5 [CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:U/U:Clear]
CVE-ID: N/A
CWE-ID:
CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Exploit availability: No
DescriptionThe disclosed vulnerability allows a remote attacker to perform cross-site scripting (XSS) attacks.
The vulnerability exists due to insufficient sanitization of user-supplied data in "/Meta/src/Template/Admin/Meta/form.ctp" script. A remote attacker can execute arbitrary HTML and script code in user's browser in context of vulnerable website.
Successful exploitation of this vulnerability may allow a remote attacker to steal potentially sensitive information, change appearance of the web page, perform phishing and drive-by-download attacks.
MitigationInstall updates from vendor's website.
Vulnerable software versionsCroogo: 3.0.0 - 3.0.6
CPE2.3- cpe:2.3:a:croogo:croogo:3.0.0:*:*:*:*:*:*:*
- cpe:2.3:a:croogo:croogo:3.0.0:alpha.1:*:*:*:*:*:*
- cpe:2.3:a:croogo:croogo:3.0.0:alpha.2:*:*:*:*:*:*
https://github.com/croogo/croogo/releases/tag/3.0.7
https://github.com/croogo/croogo/commit/cafaaabe2cef3d1d83652370e30563e6ad7c4158
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
5) Stored cross-site scripting
EUVDB-ID: #VU23069
Risk: Low
CVSSv4.0: 0.5 [CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:U/U:Clear]
CVE-ID: N/A
CWE-ID:
CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Exploit availability: No
DescriptionThe disclosed vulnerability allows a remote attacker to perform cross-site scripting (XSS) attacks.
The vulnerability exists due to insufficient sanitization of user-supplied data when processing breadcrumbs in "/Settings/src/Template/Admin/Settings/index.ctp" script. A remote attacker can execute arbitrary HTML and script code in user's browser in context of vulnerable website.
Successful exploitation of this vulnerability may allow a remote attacker to steal potentially sensitive information, change appearance of the web page, perform phishing and drive-by-download attacks.
MitigationInstall updates from vendor's website.
Vulnerable software versionsCroogo: 3.0.0 - 3.0.6
CPE2.3- cpe:2.3:a:croogo:croogo:3.0.0:*:*:*:*:*:*:*
- cpe:2.3:a:croogo:croogo:3.0.0:alpha.1:*:*:*:*:*:*
- cpe:2.3:a:croogo:croogo:3.0.0:alpha.2:*:*:*:*:*:*
https://github.com/croogo/croogo/releases/tag/3.0.7
https://github.com/croogo/croogo/commit/cafaaabe2cef3d1d83652370e30563e6ad7c4158
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
6) Stored cross-site scripting
EUVDB-ID: #VU23070
Risk: Low
CVSSv4.0: 0.5 [CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:U/U:Clear]
CVE-ID: N/A
CWE-ID:
CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Exploit availability: No
DescriptionThe disclosed vulnerability allows a remote attacker to perform cross-site scripting (XSS) attacks.
The vulnerability exists due to insufficient sanitization of user-supplied data passed via the user role title in "/Users/src/Template/Admin/Roles/form.ctp" script. A remote attacker can execute arbitrary HTML and script code in user's browser in context of vulnerable website.
Successful exploitation of this vulnerability may allow a remote attacker to steal potentially sensitive information, change appearance of the web page, perform phishing and drive-by-download attacks.
MitigationInstall updates from vendor's website.
Vulnerable software versionsCroogo: 3.0.0 - 3.0.6
CPE2.3- cpe:2.3:a:croogo:croogo:3.0.0:*:*:*:*:*:*:*
- cpe:2.3:a:croogo:croogo:3.0.0:alpha.1:*:*:*:*:*:*
- cpe:2.3:a:croogo:croogo:3.0.0:alpha.2:*:*:*:*:*:*
https://github.com/croogo/croogo/releases/tag/3.0.7
https://github.com/croogo/croogo/commit/cafaaabe2cef3d1d83652370e30563e6ad7c4158
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
7) Stored cross-site scripting
EUVDB-ID: #VU23071
Risk: Medium
CVSSv4.0: 1.2 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:U/U:Green]
CVE-ID: N/A
CWE-ID:
CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Exploit availability: No
DescriptionThe disclosed vulnerability allows a remote attacker to perform cross-site scripting (XSS) attacks.
The vulnerability exists due to insufficient sanitization of user-supplied data passed via the username in "/Users/src/Template/Admin/Users/form.ctp" script. A remote attacker can execute arbitrary HTML and script code in user's browser in context of vulnerable website.
Successful exploitation of this vulnerability may allow a remote attacker to steal potentially sensitive information, change appearance of the web page, perform phishing and drive-by-download attacks.
MitigationInstall updates from vendor's website.
Vulnerable software versionsCroogo: 3.0.0 - 3.0.6
CPE2.3- cpe:2.3:a:croogo:croogo:3.0.0:*:*:*:*:*:*:*
- cpe:2.3:a:croogo:croogo:3.0.0:alpha.1:*:*:*:*:*:*
- cpe:2.3:a:croogo:croogo:3.0.0:alpha.2:*:*:*:*:*:*
https://github.com/croogo/croogo/releases/tag/3.0.7
https://github.com/croogo/croogo/commit/cafaaabe2cef3d1d83652370e30563e6ad7c4158
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
8) Stored cross-site scripting
EUVDB-ID: #VU23064
Risk: Low
CVSSv4.0: 0.5 [CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:U/U:Clear]
CVE-ID: N/A
CWE-ID:
CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Exploit availability: No
DescriptionThe disclosed vulnerability allows a remote attacker to perform cross-site scripting (XSS) attacks.
The vulnerability exists due to insufficient sanitization of user-supplied data via the menu title in "/Menus/src/Template/Admin/Links/form.ctp", "/Menus/src/Template/Admin/Links/index.ctp", and "/Menus/src/Template/Admin/Menus/form.ctp" scripts. A remote attacker can execute arbitrary HTML and script code in user's browser in context of vulnerable website.
Successful exploitation of this vulnerability may allow a remote attacker to steal potentially sensitive information, change appearance of the web page, perform phishing and drive-by-download attacks.
MitigationInstall updates from vendor's website.
Vulnerable software versionsCroogo: 3.0.0 - 3.0.6
CPE2.3- cpe:2.3:a:croogo:croogo:3.0.0:*:*:*:*:*:*:*
- cpe:2.3:a:croogo:croogo:3.0.0:alpha.1:*:*:*:*:*:*
- cpe:2.3:a:croogo:croogo:3.0.0:alpha.2:*:*:*:*:*:*
https://github.com/croogo/croogo/releases/tag/3.0.7
https://github.com/croogo/croogo/commit/cafaaabe2cef3d1d83652370e30563e6ad7c4158
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
9) Stored cross-site scripting
EUVDB-ID: #VU23063
Risk: Medium
CVSSv4.0: 2.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:U/U:Green]
CVE-ID: N/A
CWE-ID:
CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Exploit availability: No
DescriptionThe disclosed vulnerability allows a remote attacker to perform cross-site scripting (XSS) attacks.
The vulnerability exists due to insufficient sanitization of user-supplied data when processing links in "/Core/src/View/Helper/CroogoHtmlHelper.php" script. A remote attacker can execute arbitrary HTML and script code in user's browser in context of vulnerable website.
Successful exploitation of this vulnerability may allow a remote attacker to steal potentially sensitive information, change appearance of the web page, perform phishing and drive-by-download attacks.
MitigationInstall updates from vendor's website.
Vulnerable software versionsCroogo: 3.0.0 - 3.0.6
CPE2.3- cpe:2.3:a:croogo:croogo:3.0.0:*:*:*:*:*:*:*
- cpe:2.3:a:croogo:croogo:3.0.0:alpha.1:*:*:*:*:*:*
- cpe:2.3:a:croogo:croogo:3.0.0:alpha.2:*:*:*:*:*:*
https://github.com/croogo/croogo/releases/tag/3.0.7
https://github.com/croogo/croogo/commit/cafaaabe2cef3d1d83652370e30563e6ad7c4158
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
10) Cross-site scripting
EUVDB-ID: #VU23057
Risk: Low
CVSSv4.0: 0.5 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:U/U:Clear]
CVE-ID: N/A
CWE-ID:
CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Exploit availability: No
DescriptionThe disclosed vulnerability allows a remote attacker to perform cross-site scripting (XSS) attacks.
The vulnerability exists due to insufficient sanitization of user-supplied data via Block title in "/Blocks/src/Template/Admin/Blocks/form.ctp" script. A remote attacker can execute arbitrary HTML and script code in user's browser in context of vulnerable website.
Successful exploitation of this vulnerability may allow a remote attacker to steal potentially sensitive information, change appearance of the web page, perform phishing and drive-by-download attacks.
MitigationInstall updates from vendor's website.
Vulnerable software versionsCroogo: 3.0.0 - 3.0.6
CPE2.3- cpe:2.3:a:croogo:croogo:3.0.0:*:*:*:*:*:*:*
- cpe:2.3:a:croogo:croogo:3.0.0:alpha.1:*:*:*:*:*:*
- cpe:2.3:a:croogo:croogo:3.0.0:alpha.2:*:*:*:*:*:*
https://github.com/croogo/croogo/releases/tag/3.0.7
https://github.com/croogo/croogo/commit/cafaaabe2cef3d1d83652370e30563e6ad7c4158
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
11) Cross-site scripting
EUVDB-ID: #VU23055
Risk: Low
CVSSv4.0: 0.5 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:U/U:Clear]
CVE-ID: N/A
CWE-ID:
CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Exploit availability: No
DescriptionThe disclosed vulnerability allows a remote attacker to perform cross-site scripting (XSS) attacks.
The vulnerability exists due to insufficient sanitization of user-supplied data via the vocabulary title and description in "/Taxonomy/src/Event/TaxonomiesEventHandler.php", vocabulary title in "/Taxonomy/src/Template/Admin/Terms/index.ctp" script, via the column title in "/Taxonomy/src/Template/Admin/Terms/chooser.ctp" script and via the title in "/Taxonomy/src/Template/Admin/Types/form.ctp" script. A remote attacker can execute arbitrary HTML and script code in user's browser in context of vulnerable website.
Successful exploitation of this vulnerability may allow a remote attacker to steal potentially sensitive information, change appearance of the web page, perform phishing and drive-by-download attacks.
MitigationInstall updates from vendor's website.
Vulnerable software versionsCroogo: 3.0.0 - 3.0.6
CPE2.3- cpe:2.3:a:croogo:croogo:3.0.0:*:*:*:*:*:*:*
- cpe:2.3:a:croogo:croogo:3.0.0:alpha.1:*:*:*:*:*:*
- cpe:2.3:a:croogo:croogo:3.0.0:alpha.2:*:*:*:*:*:*
https://github.com/croogo/croogo/releases/tag/3.0.7
https://github.com/croogo/croogo/commit/4edb1ff597b4cfa01db73163a6cbd6d11ac4e8f0
https://github.com/croogo/croogo/commit/cafaaabe2cef3d1d83652370e30563e6ad7c4158
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
12) Cross-site scripting
EUVDB-ID: #VU23054
Risk: Medium
CVSSv4.0: 0.5 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:U/U:Green]
CVE-ID: N/A
CWE-ID:
CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Exploit availability: No
DescriptionThe disclosed vulnerability allows a remote attacker to perform cross-site scripting (XSS) attacks.
The vulnerability exists due to insufficient sanitization of user-supplied data passed via the "title" HTTP parameter in "/Nodes/src/Event/NodesEventHandler.php" and "/Nodes/src/Template/Admin/Nodes/chooser.ctp" scripts. A remote attacker can execute arbitrary HTML and script code in user's browser in context of vulnerable website.
Successful exploitation of this vulnerability may allow a remote attacker to steal potentially sensitive information, change appearance of the web page, perform phishing and drive-by-download attacks.
MitigationInstall updates from vendor's website.
Vulnerable software versionsCroogo: 3.0.0 - 3.0.6
CPE2.3- cpe:2.3:a:croogo:croogo:3.0.0:*:*:*:*:*:*:*
- cpe:2.3:a:croogo:croogo:3.0.0:alpha.1:*:*:*:*:*:*
- cpe:2.3:a:croogo:croogo:3.0.0:alpha.2:*:*:*:*:*:*
https://github.com/croogo/croogo/releases/tag/3.0.7
https://github.com/croogo/croogo/commit/4edb1ff597b4cfa01db73163a6cbd6d11ac4e8f0
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
13) Cross-site scripting
EUVDB-ID: #VU23058
Risk: Low
CVSSv4.0: 0.5 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:U/U:Clear]
CVE-ID: N/A
CWE-ID:
CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Exploit availability: No
DescriptionThe disclosed vulnerability allows a remote attacker to perform cross-site scripting (XSS) attacks.
The vulnerability exists due to insufficient sanitization of user-supplied data via Region title in "/Blocks/src/Template/Admin/Regions/form.ctp" script. A remote attacker can execute arbitrary HTML and script code in user's browser in context of vulnerable website.
Successful exploitation of this vulnerability may allow a remote attacker to steal potentially sensitive information, change appearance of the web page, perform phishing and drive-by-download attacks.
MitigationInstall updates from vendor's website.
Vulnerable software versionsCroogo: 3.0.0 - 3.0.6
CPE2.3- cpe:2.3:a:croogo:croogo:3.0.0:*:*:*:*:*:*:*
- cpe:2.3:a:croogo:croogo:3.0.0:alpha.1:*:*:*:*:*:*
- cpe:2.3:a:croogo:croogo:3.0.0:alpha.2:*:*:*:*:*:*
https://github.com/croogo/croogo/releases/tag/3.0.7
https://github.com/croogo/croogo/commit/cafaaabe2cef3d1d83652370e30563e6ad7c4158
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
14) Stored cross-site scripting
EUVDB-ID: #VU23059
Risk: Low
CVSSv4.0: 0.5 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:U/U:Clear]
CVE-ID: N/A
CWE-ID:
CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Exploit availability: No
DescriptionThe disclosed vulnerability allows a remote attacker to perform cross-site scripting (XSS) attacks.
The vulnerability exists due to insufficient sanitization of user-supplied data via Contact title, message title when editing the contact in "/Contacts/src/Template/Admin/Contacts/form.ctp" script. A remote attacker can execute arbitrary HTML and script code in user's browser in context of vulnerable website.
Successful exploitation of this vulnerability may allow a remote attacker to steal potentially sensitive information, change appearance of the web page, perform phishing and drive-by-download attacks.
MitigationInstall updates from vendor's website.
Vulnerable software versionsCroogo: 3.0.0 - 3.0.6
CPE2.3- cpe:2.3:a:croogo:croogo:3.0.0:*:*:*:*:*:*:*
- cpe:2.3:a:croogo:croogo:3.0.0:alpha.1:*:*:*:*:*:*
- cpe:2.3:a:croogo:croogo:3.0.0:alpha.2:*:*:*:*:*:*
https://github.com/croogo/croogo/releases/tag/3.0.7
https://github.com/croogo/croogo/commit/cafaaabe2cef3d1d83652370e30563e6ad7c4158
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
15) Cross-site scripting
EUVDB-ID: #VU23062
Risk: Low
CVSSv4.0: 0.5 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:U/U:Clear]
CVE-ID: N/A
CWE-ID:
CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Exploit availability: No
DescriptionThe disclosed vulnerability allows a remote attacker to perform cross-site scripting (XSS) attacks.
The vulnerability exists due to insufficient sanitization of user-supplied data via the menu title in "/Core/src/View/Helper/CroogoHelper.php" script. A remote attacker can execute arbitrary HTML and script code in user's browser in context of vulnerable website.
Successful exploitation of this vulnerability may allow a remote attacker to steal potentially sensitive information, change appearance of the web page, perform phishing and drive-by-download attacks.
MitigationInstall updates from vendor's website.
Vulnerable software versionsCroogo: 3.0.0 - 3.0.6
CPE2.3- cpe:2.3:a:croogo:croogo:3.0.0:*:*:*:*:*:*:*
- cpe:2.3:a:croogo:croogo:3.0.0:alpha.1:*:*:*:*:*:*
- cpe:2.3:a:croogo:croogo:3.0.0:alpha.2:*:*:*:*:*:*
https://github.com/croogo/croogo/releases/tag/3.0.7
https://github.com/croogo/croogo/commit/cafaaabe2cef3d1d83652370e30563e6ad7c4158
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
16) Stored cross-site scripting
EUVDB-ID: #VU23061
Risk: Medium
CVSSv4.0: 2.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:U/U:Green]
CVE-ID: N/A
CWE-ID:
CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Exploit availability: No
DescriptionThe disclosed vulnerability allows a remote attacker to perform cross-site scripting (XSS) attacks.
The vulnerability exists due to insufficient sanitization of user-supplied data via the message title in "/Contacts/src/Template/Admin/Messages/view.ctp" script. A remote attacker can execute arbitrary HTML and script code in user's browser in context of vulnerable website.
Successful exploitation of this vulnerability may allow a remote attacker to steal potentially sensitive information, change appearance of the web page, perform phishing and drive-by-download attacks.
MitigationInstall updates from vendor's website.
Vulnerable software versionsCroogo: 3.0.0 - 3.0.6
CPE2.3- cpe:2.3:a:croogo:croogo:3.0.0:*:*:*:*:*:*:*
- cpe:2.3:a:croogo:croogo:3.0.0:alpha.1:*:*:*:*:*:*
- cpe:2.3:a:croogo:croogo:3.0.0:alpha.2:*:*:*:*:*:*
https://github.com/croogo/croogo/releases/tag/3.0.7
https://github.com/croogo/croogo/commit/cafaaabe2cef3d1d83652370e30563e6ad7c4158
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
17) Stored cross-site scripting
EUVDB-ID: #VU23060
Risk: Medium
CVSSv4.0: 2.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:U/U:Green]
CVE-ID: N/A
CWE-ID:
CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Exploit availability: No
DescriptionThe disclosed vulnerability allows a remote attacker to perform cross-site scripting (XSS) attacks.
The vulnerability exists due to insufficient sanitization of user-supplied data via the Contact title, message name, message email, message title, message body in "/Contacts/src/Template/Admin/Messages/index.ctp" script. A remote attacker can execute arbitrary HTML and script code in user's browser in context of vulnerable website.
Successful exploitation of this vulnerability may allow a remote attacker to steal potentially sensitive information, change appearance of the web page, perform phishing and drive-by-download attacks.
MitigationInstall updates from vendor's website.
Vulnerable software versionsCroogo: 3.0.0 - 3.0.6
CPE2.3- cpe:2.3:a:croogo:croogo:3.0.0:*:*:*:*:*:*:*
- cpe:2.3:a:croogo:croogo:3.0.0:alpha.1:*:*:*:*:*:*
- cpe:2.3:a:croogo:croogo:3.0.0:alpha.2:*:*:*:*:*:*
https://github.com/croogo/croogo/releases/tag/3.0.7
https://github.com/croogo/croogo/commit/cafaaabe2cef3d1d83652370e30563e6ad7c4158
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
18) Cross-site scripting
EUVDB-ID: #VU23053
Risk: Low
CVSSv4.0: 0.5 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:U/U:Clear]
CVE-ID: N/A
CWE-ID:
CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Exploit availability: No
DescriptionThe disclosed vulnerability allows a remote attacker to perform cross-site scripting (XSS) attacks.
The vulnerability exists due to insufficient sanitization of user-supplied data passed via the attachment title in "/Core/src/Template/Cell/Admin/LinkChooser/display.ctp", "/FileManager/src/Template/Admin/Attachments/chooser.ctp", "/FileManager/src/Template/Admin/Attachments/browse.ctp", "/FileManager/src/Template/Admin/Attachments/edit.ctp", and "/FileManager/src/Template/Admin/Attachments/index.ctp" scripts. A remote attacker can execute arbitrary HTML and script code in user's browser in context of vulnerable website.
Successful exploitation of this vulnerability may allow a remote attacker to steal potentially sensitive information, change appearance of the web page, perform phishing and drive-by-download attacks.
MitigationInstall updates from vendor's website.
Vulnerable software versionsCroogo: 3.0.0 - 3.0.6
CPE2.3- cpe:2.3:a:croogo:croogo:3.0.0:*:*:*:*:*:*:*
- cpe:2.3:a:croogo:croogo:3.0.0:alpha.1:*:*:*:*:*:*
- cpe:2.3:a:croogo:croogo:3.0.0:alpha.2:*:*:*:*:*:*
https://github.com/croogo/croogo/releases/tag/3.0.7
https://github.com/croogo/croogo/commit/4edb1ff597b4cfa01db73163a6cbd6d11ac4e8f0
https://github.com/croogo/croogo/commit/cafaaabe2cef3d1d83652370e30563e6ad7c4158
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
