GitHub Advisoryadvisory · RubyGems

GHSA-x78v-4fvj-rg9j Camaleon CMS Stored Cross-site Scripting vulnerability

MEDIUM Published 2022-05-24 Modified 2023-01-26 Official page ↗
Aliases
CVE-2021-25969
Ecosystem
RubyGems
Packages
camaleon_cms
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Weaknesses
CWE-79
Reviewed
2023-01-26

Affected packages

• RubyGems camaleon_cms: >= 0.0.1, < 2.6.0.1 → fixed in 2.6.0.1

Description

In “Camaleon CMS” application, versions 0.0.1 through 2.6.0 are vulnerable to stored XSS, that allows unprivileged application users to store malicious scripts in the comments section of the post. These scripts are executed in a victim’s browser when they open the page containing the malicious comment.

Related

Alias · CVE (1)

  • CVE-2021-25969 In Camaleon CMS application, versions 0.0.1 to 2.6.0 are vulnerable to stored XSS, that allows an unauthenticated attacker to store… vulnerability

Weakness · CWE (1)

  • CWE-79 Improper Neutralization of Input During Web Page Generation weakness

References