CVE-2022-23049
Exponent CMS 2.6.0patch2 allows an authenticated user to inject persistent JavaScript code on the "User-Agent" header when logging in. When an adminis...
Description d'origine
La description telle que publiée par la source (souvent en anglais).
Exponent CMS 2.6.0patch2 allows an authenticated user to inject persistent JavaScript code on the "User-Agent" header when logging in. When an administrator user visits the "User Sessions" tab, the JavaScript will be triggered allowing an attacker to compromise the administrator session.
Références
- advisory fluidattacks.com
- advisory github.com
- advisory nvd.nist.gov
- report github.com
- web exponentcms.lighthouseapp.com