Stored Cross-Site Scripting Vulnerability in Croogo Blog Management
CVE-2019-7168

4.8MEDIUM

Key Information:

Vendor

Croogo

Status
Croogo
Vendor
CVE Published:
29 January 2019

What is CVE-2019-7168?

A stored Cross-Site Scripting (XSS) vulnerability exists in Croogo prior to version 3.0.5. This flaw allows attackers to inject malicious HTML or JavaScript code within the Blog field of the application. When users access affected pages, the injected scripts can execute in their browsers, potentially leading to unauthorized actions, data exfiltration, or session hijacking. It is essential for administrators to update to the latest version to mitigate this risk.

References

https://github.com/croogo/croogo/issues/886
x_refsource_MISC

CVSS V3.1

Score:
4.8
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
High
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability Reserved

  • Vulnerability published

JSON
.
CVE-2019-7168 : Stored Cross-Site Scripting Vulnerability in Croogo Blog Management