Cross Site Scripting Vulnerability in Textpattern CMS by Textpattern
CVE-2020-23239

4.8MEDIUM

Key Information:

Vendor

Textpattern

Status
Textpattern
Vendor
CVE Published:
26 July 2021

What is CVE-2020-23239?

The vulnerability in Textpattern CMS 4.8.1 enables attackers to exploit custom fields in the Menu Preferences feature, leading to potential Cross Site Scripting (XSS) attacks. This flaw allows unauthorized scripts to be executed in the context of a user’s session, posing significant security risks. Users are advised to review the affected areas and apply necessary updates to mitigate potential exploitation.

References

https://github.com/textpattern/textpattern/issues/1495
x_refsource_MISC

CVSS V3.1

Score:
4.8
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
High
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.