CVE-2021-25969

Description

In Camaleon CMS application, versions 0.0.1 to 2.6.0 are vulnerable to stored XSS, that allows an unauthenticated attacker to store malicious scripts in the comments section of the post. These scripts are executed in a victims browser when they open the page containing the malicious comment.

Risk Information

Base Score

6.1

MODERATE

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

EPSS Score

Exploitation Probability

1.357

Associated Vulnerability

Vulnerability	OS Platform
Vulnerabilities CVE-2021-25969,CVE-2021-25970,CVE-2021-25971,CVE-2021-25972 are fixed in Ruby-camaleon_cms 2.6.0.1	Windows
Vulnerabilities CVE-2021-25969,CVE-2021-25970,CVE-2021-25971,CVE-2021-25972 are fixed in Ruby-camaleon_cms for Linux 2.6.0.1	Linux

Patch Details

No records found

References

https://nvd.nist.gov/vuln/detail/CVE-2023-1234
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-1234