CVE-2022-23047

Exponent CMS 2.6.0patch2 allows an authenticated admin user to inject persistent JavaScript code inside the "Site/Organization Name","Site Title" and...

Description d'origine

La description telle que publiée par la source (souvent en anglais).

Exponent CMS 2.6.0patch2 allows an authenticated admin user to inject persistent JavaScript code inside the "Site/Organization Name","Site Title" and "Site Header" parameters while updating the site settings on "/exponentcms/administration/configure_site"

Source: OSV.dev (Open Source Vulnerabilities) NVD OSV

Références

advisory fluidattacks.com
advisory github.com
advisory nvd.nist.gov
report github.com
web exponentcms.lighthouseapp.com