Cross-Site Scripting Vulnerability in Ivan Cordoba Generic Content Management System
CVE-2018-20589

4.8MEDIUM

Key Information:

Vendor: Generic Content Management System Project
Status: Generic Content Management System
Vendor: CVE Published:; 30 December 2018

🔔 Create Generic Content Management System Project Vulnerability Alert

What is CVE-2018-20589?

The Ivan Cordoba Generic Content Management System prior to April 28, 2018, is susceptible to a cross-site scripting attack via the 'Administrator/add_pictures.php' endpoint, specifically through manipulation of the article ID parameter. This flaw can allow attackers to inject malicious scripts into web pages viewed by users, potentially compromising sensitive information and user interactions.

References

https://github.com/nabby27/CMS/pull/3

x_refsource_MISC

CVSS V3.1

Score:

4.8

Severity:

MEDIUM

Confidentiality:

Low

Integrity:

Low

Availability:

Low

Attack Vector:

Network

Attack Complexity:

Low

Privileges Required:

High

User Interaction:

Required

Scope:

Changed

Download the Critical Vulnerability Management Cheat Sheet

Timeline

Vulnerability published
Dec 30, 2018
Vulnerability Reserved
Dec 30, 2018

CVE-2018-20589 Data

JSON