Cross-site scripting in Camaleon CMS - #VU162671
Published: September 18, 2024 / Updated: November 9, 2026
Vulnerability identifier: #VU162671
CSH Severity: Low
CVSS v4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N]
CVE-ID: N/A
CWE-ID: CWE-79
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a low-privileged authenticated attacker to execute stored JavaScript in another authenticated user's or administrator's browser and act with the victim's privileges.
The vulnerability exists due to Camaleon CMS accepting and serving script-bearing SVG or HTML uploads as browser-renderable content. A low-privileged authenticated attacker can upload a malicious file and induce a victim to visit it, exposing authentication tokens and enabling unauthorized changes to CMS content.
Affected software
Camaleon CMS
Remediation
Install security update from vendor's website.
Camaleon CMS - update to 2.8.2