XSS Injection in Media Collection Title was possible
CVE-2021-32737

8.4HIGH

Key Information:

Vendor

Sulu

Status
Sulu
Vendor
CVE Published:
2 July 2021

What is CVE-2021-32737?

Sulu is an open-source PHP content management system based on the Symfony framework. In versions of Sulu prior to 1.6.41, it is possible for a logged in admin user to add a script injection (cross-site-scripting) in the collection title. The problem is patched in version 1.6.41. As a workaround, one may manually patch the affected JavaScript files in lieu of updating.

Affected Version(s)

sulu < 1.6.41

References

https://github.com/sulu/sulu/security/advisories/GHSA-gm2...
x_refsource_CONFIRM
https://github.com/sulu/sulu/releases/tag/1.6.41
x_refsource_MISC

CVSS V3.1

Score:
8.4
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
High
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.