GitHub Advisoryadvisory · Packagist

GHSA-7mq6-cp5m-f4j5 Cross-site Scripting in Anchor CMS

MEDIUM Published 2022-01-05 Modified 2022-01-04 Official page ↗
Aliases
CVE-2021-44116
Ecosystem
Packagist
Packages
anchorcms/anchor-cms
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Weaknesses
CWE-79
Reviewed
2022-01-04

Affected packages

• Packagist anchorcms/anchor-cms: <= 0.12.7 (no fix yet)

Description

Cross Site Scripting (XSS) vulnerability exits in Anchor CMS <=0.12.7 in posts.php. Attackers can use the posts column to upload the title and content containing malicious code to achieve the purpose of obtaining the administrator cookie, thereby achieving other malicious operations.

Related

Alias · CVE (1)

  • CVE-2021-44116 Cross Site Scripting (XSS) vulnerability exits in Anchor CMS <=0.12.7 in posts.php. vulnerability

Weakness · CWE (1)

  • CWE-79 Improper Neutralization of Input During Web Page Generation weakness

References