6.4Orta
CVE-2020-36955Grav CMS 1.6.30 Admin Plugin 1.9.18 - 'Page Title' Persistent Cross-Site Scripting
Açıklama
Grav CMS 1.6.30 with Admin Plugin 1.9.18 contains a persistent cross-site scripting vulnerability that allows authenticated attackers to inject malicious scripts through the page title field. Attackers can create a new page with a malicious script in the title, which will be executed when the page is viewed in the admin panel or on the site.
Zayıflık türü (CWE):
CWE-79
Veri: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Bilgiler kaynaktaki haliyle, İngilizce yayımlanır.
Etkilenen ürünler ve sürümler
| Üretici | Ürün | Sürümler | |
|---|---|---|---|
| Getgrav | Grav CMS Admin Plugin | ≤ 1.9.18 | |
| getgrav | grav-plugin-admin | ≤ 1.9.18 |
Kaynaklar ve yamalar
- ExploitDB-49264 exploit
- Grav CMS Official Homepage product
- VulnCheck Advisory: Grav CMS 1.6.30 Admin Plugin 1.9.18 - 'Page Title' Persistent Cross-Site Scripting third-party-advisory