#VU23055 Cross-site scripting in Croogo

Description

The disclosed vulnerability allows a remote attacker to perform cross-site scripting (XSS) attacks.

The vulnerability exists due to insufficient sanitization of user-supplied data via the vocabulary title and description in "/Taxonomy/src/Event/TaxonomiesEventHandler.php", vocabulary title in "/Taxonomy/src/Template/Admin/Terms/index.ctp" script, via the column title in "/Taxonomy/src/Template/Admin/Terms/chooser.ctp" script and via the title in "/Taxonomy/src/Template/Admin/Types/form.ctp" script. A remote attacker can execute arbitrary HTML and script code in user's browser in context of vulnerable website.

Successful exploitation of this vulnerability may allow a remote attacker to steal potentially sensitive information, change appearance of the web page, perform phishing and drive-by-download attacks.

Remediation

External links

• https://github.com/croogo/croogo/releases/tag/3.0.7
• https://github.com/croogo/croogo/commit/4edb1ff597b4cfa01db73163a6cbd6d11ac4e8f0
• https://github.com/croogo/croogo/commit/cafaaabe2cef3d1d83652370e30563e6ad7c4158