GitHub Advisoryadvisory · Packagist

GHSA-v2f3-f8x4-m3w8 Cross Site Scripting in LavaLite CMS

MEDIUM Published 2021-08-09 Modified 2023-07-06 Official page ↗
Aliases
CVE-2020-23234
Ecosystem
Packagist
Packages
lavalite/cms
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
Weaknesses
CWE-79
Reviewed
2021-08-02

Affected packages

• Packagist lavalite/cms: <= 5.8.0 (no fix yet)

Description

Cross Site Scripting (XSS) vulnerabiity exists in LavaLite CMS 5.8.0 via the Menu Blocks feature, which can be bypassed by using HTML event handlers, such as "ontoggle,".

Related

Alias · CVE (1)

  • CVE-2020-23234 Cross Site Scripting (XSS) vulnerabiity exists in LavaLite CMS 5.8.0 via the Menu Blocks feature, which can be bypassed by using HTML event… vulnerability

Weakness · CWE (1)

  • CWE-79 Improper Neutralization of Input During Web Page Generation weakness

References