CVE-2023-31698

Опубликовано: 17 мая 2023

Источник: nvd

CVSS3: 5.4

EPSS Низкий

Описание

Bludit v3.14.1 is vulnerable to Stored Cross Site Scripting (XSS) via SVG file on site logo. NOTE: the product's security model is that users are trusted by the administrator to insert arbitrary content (users cannot create their own accounts through self-registration).

Ссылки

http://packetstormsecurity.com/files/172462/Bludit-CMS-3.14.1-Cross-Site-Scripting.html
Exploit
Third Party Advisory
VDB Entry
https://github.com/bludit/bludit/issues/1212#issuecomment-649514491
https://github.com/bludit/bludit/issues/1369#issuecomment-940806199
https://github.com/bludit/bludit/issues/1509
Exploit
http://packetstormsecurity.com/files/172462/Bludit-CMS-3.14.1-Cross-Site-Scripting.html
Exploit
Third Party Advisory
VDB Entry
https://github.com/bludit/bludit/issues/1212#issuecomment-649514491
https://github.com/bludit/bludit/issues/1369#issuecomment-940806199
https://github.com/bludit/bludit/issues/1509
Exploit

Уязвимые конфигурации

Конфигурация 1

cpe:2.3:a:bludit:bludit:3.14.1:*:*:*:*:*:*:*

EPSS

Процентиль: 84%

0.02586

Низкий

5.4 Medium

CVSS3

Дефекты

CWE-79

Связанные уязвимости

GHSA-3r55-8c76-hvc2