GitHub Advisoryadvisory · Packagist

GHSA-m2r2-qc49-gqw4 Gleez CMS Stored XSS

MEDIUM Published 2022-05-14 Modified 2023-10-06 Official page ↗
Aliases
CVE-2018-7035
Ecosystem
Packagist
Packages
gleez/cms
Severity
Moderate
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Weaknesses
CWE-79
Reviewed
2023-07-25

Affected packages

• Packagist gleez/cms: <= 1.2.0 (no fix yet) • Packagist gleez/cms: 2.0.0 (no fix yet)

Description

Cross-site scripting (XSS) vulnerability in Gleez CMS 1.2.0 and 2.0 might allow remote attackers (users) to inject JavaScript via HTML content in an editor, which will result in Stored XSS when an Administrator tries to edit the same content, as demonstrated by use of the source editor for HTML mode in an Add Blog action.

Related

Alias · CVE (1)

  • CVE-2018-7035 Cross-site scripting (XSS) vulnerability in Gleez CMS 1.2.0 and 2.0 might allow remote attackers (users) to inject JavaScript via HTML… vulnerability

Weakness · CWE (1)

  • CWE-79 Improper Neutralization of Input During Web Page Generation weakness

References