Stored Self XSS in Croogo Affects Various Versions
CVE-2019-7171

4.8MEDIUM

Key Information:

Vendor

Croogo

Status
Croogo
Vendor
CVE Published:
29 January 2019

What is CVE-2019-7171?

A stored self XSS vulnerability exists in Croogo versions prior to v3.0.5, allowing attackers to inject and execute HTML or JavaScript code via the Title field in administrative block editing. This can lead to unauthorized actions and data exposure, making it crucial for users to apply the necessary patches and updates to secure their applications.

References

https://github.com/croogo/croogo/issues/887
x_refsource_MISC

CVSS V3.1

Score:
4.8
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
High
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability Reserved

  • Vulnerability published

JSON
.
CVE-2019-7171 : Stored Self XSS in Croogo Affects Various Versions