Cross-Site Scripting Vulnerability in LavaLite CMS by LavaLite
CVE-2018-16551

5.4MEDIUM

Key Information:

Vendor

Lavalite

Status
Lavalite
Vendor
CVE Published:
5 September 2018

What is CVE-2018-16551?

LavaLite 5.5 has a vulnerability that allows for Cross-Site Scripting through a specially crafted URI. This issue can be exploited when accessing the /edit endpoint, such as in the path /client/job/job/Zy8PWBekrJ/edit, potentially allowing attackers to inject malicious scripts leading to unauthorized actions or data theft.

References

https://github.com/LavaLite/cms/issues/259
x_refsource_MISC

CVSS V3.1

Score:
5.4
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.