Cross-Site Scripting Vulnerability in CMS Made Simple by CMS Made Simple
CVE-2020-23481

5.4MEDIUM

Key Information:

Vendor

Cmsmadesimple

Status
Cms Made Simple
Vendor
CVE Published:
22 September 2021

What is CVE-2020-23481?

CMS Made Simple versions up to 2.2.14 are susceptible to a cross-site scripting (XSS) vulnerability. This flaw enables an attacker to inject arbitrary web scripts or HTML code by submitting a crafted payload in the Field Definition text field. When exploited, this vulnerability can lead to unauthorized actions being carried out on behalf of users, compromising the security of web applications based on this CMS.

References

http://dev.cmsmadesimple.org/bug/view/12317
x_refsource_MISC

CVSS V3.1

Score:
5.4
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.