CVE-2020-24860

Опубликовано: 01 окт. 2020

Источник: nvd

CVSS3: 5.4

CVSS2: 3.5

EPSS Низкий

Описание

CMS Made Simple 2.2.14 allows an authenticated user with access to the Content Manager to edit content and put persistent XSS payload in the affected text fields. The user can get cookies from every authenticated user who visits the website.

Ссылки

http://packetstormsecurity.com/files/159434/CMS-Made-Simple-2.2.14-Cross-Site-Scripting.html
Exploit
Third Party Advisory
VDB Entry
https://www.cmsmadesimple.org
Product
https://www.exploit-db.com/exploits/48851
Exploit
Third Party Advisory
VDB Entry
https://www.youtube.com/watch?v=M6D7DmmjLak&t=22s
Exploit
Third Party Advisory
http://packetstormsecurity.com/files/159434/CMS-Made-Simple-2.2.14-Cross-Site-Scripting.html
Exploit
Third Party Advisory
VDB Entry
https://www.cmsmadesimple.org
Product
https://www.exploit-db.com/exploits/48851
Exploit
Third Party Advisory
VDB Entry
https://www.youtube.com/watch?v=M6D7DmmjLak&t=22s
Exploit
Third Party Advisory

Уязвимые конфигурации

Конфигурация 1

cpe:2.3:a:cmsmadesimple:cms_made_simple:2.2.14:*:*:*:*:*:*:*

EPSS

Процентиль: 70%

0.00634

Низкий

5.4 Medium

CVSS3

3.5 Low

CVSS2

Дефекты

CWE-79

Связанные уязвимости

GHSA-853f-f4qr-34h8

github

больше 3 лет назад