Cross-Site Scripting in YzmCMS 5.6 by YzmCMS
CVE-2020-23369

6.1MEDIUM

Key Information:

Vendor
Yzmcms
Status
Yzmcms
Vendor
CVE Published:
10 May 2021

Summary

An XSS vulnerability has been identified in YzmCMS version 5.6, specifically within the member/member_content/init.html file. This issue arises from improper handling of the SRC attribute in an IFRAME element when using UEditor version 1.4.3.3. This oversight allows attackers to execute arbitrary scripts in the context of users' browsers, potentially compromising user accounts and data integrity.

References

https://github.com/yzmcms/yzmcms/issues/46
x_refsource_MISC

CVSS V3.1

Score:
6.1
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.