Cross-Site Scripting Vulnerability in WonderCMS 3.1.3
CVE-2020-29247

4.8MEDIUM

Key Information:

Vendor

Wondercms

Status
Wondercms
Vendor
CVE Published:
24 December 2020
đź”” Create Wondercms Vulnerability Alert

What is CVE-2020-29247?

WonderCMS 3.1.3 is susceptible to a cross-site scripting (XSS) vulnerability present in the Admin Panel. This flaw allows an attacker to inject malicious payloads into Page keywords. Subsequently, any user visiting the compromised page inadvertently executes the injected script, enabling the attacker to capture user cookies and conduct further malicious activities. It highlights the need for enhanced input validation and output encoding to protect against such threats.

References

http://wondercms.com
x_refsource_MISC
https://www.exploit-db.com/exploits/49102
x_refsource_MISC
https://systemweakness.com/cve-2020-29247-wondercms-3-1-3...
x_refsource_MISC

CVSS V3.1

Score:
4.8
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
High
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.
CVE-2020-29247 : Cross-Site Scripting Vulnerability in WonderCMS 3.1.3