Cross Site Scripting Vulnerability in Public CMS Voting Management
CVE-2024-11175

4.8MEDIUM

Key Information:

Vendor

Publiccms

Status
Publiccms
Vendor
CVE Published:
13 November 2024

What is CVE-2024-11175?

A vulnerability in the Voting Management component of Public CMS allows for cross site scripting (XSS) attacks due to improper handling of the /admin/cmsVote/save file. This flaw can be exploited remotely, enabling an attacker to inject malicious scripts into web pages viewed by users. The vulnerability has been disclosed publicly, and it is crucial for affected users to apply the provided patch (b9530b9cc1f5cfdad4b637874f59029a6283a65c) promptly to mitigate potential risks.

References

https://vuldb.com/?id.284351
https://vuldb.com/?ctiid.284351
https://gitee.com/sanluan/PublicCMS/issues/IB2BUV

CVSS V3.1

Score:
4.8
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
High
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

.