GitHub Advisoryadvisory · RubyGems

GHSA-mvw8-v767-qhjm Radiant CMS vulnerable to Cross-site Scripting

MEDIUM Published 2018-01-06 Modified 2023-01-26 Official page ↗

Aliases: CVE-2018-5216
Ecosystem: RubyGems
Packages: radiant
Severity: Moderate
CVSS vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Weaknesses: CWE-79
Reviewed: 2020-06-16

Affected packages

• RubyGems radiant: <= 1.1.4 (no fix yet)

Description

Radiant CMS 1.1.4 has XSS via crafted Markdown input in the `part_body_content` parameter to an `admin/pages/*/edit `resource.

Related

Alias · CVE (1)

CVE-2018-5216 Radiant CMS 1.1.4 has XSS via crafted Markdown input in the part_body_content parameter to an admin/pages/*/edit resource. vulnerability

Weakness · CWE (1)

CWE-79 Improper Neutralization of Input During Web Page Generation weakness

References