#VU34922 Cross-site scripting


Published: 2021-06-17

Vulnerability identifier: #VU34922

Vulnerability risk: Low

CVSSv3.1:

CVE-ID: CVE-2019-9554

CWE-ID: CWE-79

Exploitation vector: Network

Exploit availability: Yes

Vulnerable software:
Craft CMS
Web applications / CMS

Vendor: Pixel & Tonic, Inc.

Description

The vulnerability allows a remote non-authenticated attacker to read and manipulate data.

In the 3.1.12 Pro version of Craft CMS, XSS has been discovered in the header insertion field when adding source code at an s/admin/entries/news/new URI.

Mitigation
Install update from vendor's website.

Vulnerable software versions

Craft CMS: 3.1.12


CPE

External links
http://packetstormsecurity.com/files/151944/Craft-CMS-3.1.12-Pro-Cross-Site-Scripting.html
http://www.exploit-db.com/exploits/46496


Q & A

Can this vulnerability be exploited remotely?

Is there known malware, which exploits this vulnerability?


Latest bulletins with this vulnerability