Cross Site Scripting Vulnerability in LavaLite CMS by LavaLite
CVE-2020-28124

5.4MEDIUM

Key Information:

Vendor

Lavalite

Status
Lavalite
Vendor
CVE Published:
14 April 2021

What is CVE-2020-28124?

A Cross Site Scripting vulnerability exists in LavaLite CMS version 5.8.0, specifically within the Address field. This flaw may allow an attacker to inject malicious scripts into web pages viewed by users, potentially leading to session hijacking, content spoofing, or the spread of malware. Proper input validation and sanitization measures are essential to mitigate this risk and ensure the security of web applications built on the LavaLite framework.

References

https://github.com/418sec/huntr/tree/staging/bounties/pac...
x_refsource_MISC

CVSS V3.1

Score:
5.4
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.