Cross-site scripting in Croogo - #VU23053

Detailed vulnerability description

The disclosed vulnerability allows a remote attacker to perform cross-site scripting (XSS) attacks.

The vulnerability exists due to insufficient sanitization of user-supplied data passed via the attachment title in "/Core/src/Template/Cell/Admin/LinkChooser/display.ctp", "/FileManager/src/Template/Admin/Attachments/chooser.ctp", "/FileManager/src/Template/Admin/Attachments/browse.ctp", "/FileManager/src/Template/Admin/Attachments/edit.ctp", and "/FileManager/src/Template/Admin/Attachments/index.ctp" scripts. A remote attacker can execute arbitrary HTML and script code in user's browser in context of vulnerable website.

Successful exploitation of this vulnerability may allow a remote attacker to steal potentially sensitive information, change appearance of the web page, perform phishing and drive-by-download attacks.

Remediation

Sources

• https://github.com/croogo/croogo/releases/tag/3.0.7
• https://github.com/croogo/croogo/commit/4edb1ff597b4cfa01db73163a6cbd6d11ac4e8f0
• https://github.com/croogo/croogo/commit/cafaaabe2cef3d1d83652370e30563e6ad7c4158