Stored Cross-Site Scripting Vulnerability in ThinkCMF 6.0.7
CVE-2022-40849

5.4MEDIUM

Key Information:

Vendor

Thinkcmf

Status
Thinkcmf
Vendor
CVE Published:
1 December 2022

What is CVE-2022-40849?

ThinkCMF version 6.0.7 is vulnerable to a stored Cross-Site Scripting (XSS) attack, specifically in the Slideshow Management section. This flaw enables attackers to inject persistent XSS payloads which can execute arbitrary JavaScript on client browsers. Such exploitation can lead to various malicious activities, including unauthorized access to sensitive information, such as the administrator's PHP session token (PHPSESSID). Addressing this issue promptly is essential to safeguarding user data and maintaining application integrity.

References

https://github.com/thinkcmf/thinkcmf/issues/737

CVSS V3.1

Score:
5.4
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.