Cross Site Scripting Vulnerability in ZHENFENG13 My-Blog
CVE-2023-29636

5.4MEDIUM

Key Information:

Vendor
Zhenfeng13 My-blog Project
Status
Zhenfeng13 My-blog
Vendor
CVE Published:
1 May 2023

Summary

The vulnerability found in ZHENFENG13 My-Blog allows attackers to execute arbitrary web scripts or HTML by injecting malicious code through the 'title' field in the blog management page. This occurs due to the default configuration failing to implement necessary input sanitization methods like MyBlogUtils.cleanString, leading to the potential compromise of web application integrity and user data.

References

https://github.com/ZHENFENG13/My-Blog/issues/131

CVSS V3.1

Score:
5.4
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.