Cross-Site Scripting Vulnerability in LavaLite Content Management System
CVE-2019-17434

5.4MEDIUM

Key Information:

Vendor

Lavalite

Status
Lavalite
Vendor
CVE Published:
10 October 2019

What is CVE-2019-17434?

A Cross-Site Scripting (XSS) vulnerability exists in LavaLite CMS versions up to 5.7 that allows an attacker to exploit a crafted account name. This flaw occurs on the Manage Clients screen, where the input isn't adequately sanitized or validated, leading to the execution of malicious scripts. As a result, attackers could potentially manipulate this XSS vulnerability to carry out phishing attacks, steal sensitive information, or execute unauthorized actions within the application.

References

https://github.com/LavaLite/cms/issues/304
x_refsource_MISC

CVSS V3.1

Score:
5.4
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.