Cross Site Scripting Vulnerability in e107 SEO Project by e107
CVE-2023-36121

5.4MEDIUM

Key Information:

Vendor

E107

Status
E107
Vendor
CVE Published:
2 August 2023

What is CVE-2023-36121?

A Cross Site Scripting (XSS) vulnerability in e107 version 2.3.2 allows remote attackers to inject and execute arbitrary JavaScript code through the description function within the SEO project. This vulnerability can compromise the security of the affected web application, enabling attackers to manipulate content, steal user data, and potentially perform further exploitation of the site. Immediate action is advised to mitigate risks associated with this flaw.

References

https://www.exploit-db.com/exploits/51449
https://github.com/Trinity-SYT-SECURITY/XSS_vuln_issue/bl...
https://www.chtsecurity.com/news/6c6675d4-3254-46ce-a16d-...

CVSS V3.1

Score:
5.4
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.