CVE-2018-17876: Coaster CMS Stored Cross-site Scripting vulnerability
Summary
CVE-2018-17876: Coaster CMS Stored Cross-site Scripting vulnerability. Affects web-feet/coastercms versions 5.5.0. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Coaster CMS is a content management system that allows users to create and manage websites. It is built on the web-feet/coastercms package, which is available on Packagist. The vulnerability affects version 5.5.0 of Coaster CMS.
Vulnerability Detail
The vulnerability in Coaster CMS is a Stored Cross-site Scripting (XSS) vulnerability. This type of vulnerability allows an attacker to inject malicious scripts into a website, which can then be executed by unsuspecting users. In the case of Coaster CMS, the vulnerability exists in version 5.5.0, making websites using this version susceptible to XSS attacks. The impact of this vulnerability can range from defacement of the website to theft of sensitive user information.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no known workaround for this vulnerability. It is recommended to apply the fix provided by the developers by upgrading to a patched version of Coaster CMS.
Conclusion
In conclusion, the Coaster CMS Stored Cross-site Scripting vulnerability (CVE-2018-17876) affects version 5.5.0 of the Coaster CMS product. This vulnerability allows attackers to inject malicious scripts into websites, potentially leading to defacement or theft of sensitive user information. To mitigate the risk, users should upgrade their Coaster CMS installation to the latest patched version. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for web-feet/coastercms →
FAQ
You can use the Vulert Playground at Vulert Scanner to check if your Coaster CMS installation is affected by this vulnerability. Simply provide the composer.lock file from your installation, and Vulert will analyze it for any open-source vulnerabilities, including this one.
The impact of this vulnerability can range from defacement of the website to theft of sensitive user information. Attackers can exploit the vulnerability to inject malicious scripts into the website, which can then be executed by unsuspecting users.
Yes, the developers of Coaster CMS have released a fix for this vulnerability in a later version. It is recommended to upgrade your Coaster CMS installation to the latest version available to address the vulnerability.
There is no known workaround for this vulnerability. The recommended solution is to upgrade to a patched version of Coaster CMS.
You can find more information about this vulnerability in the Coaster CMS advisory on the GitHub Advisory Database. The advisory provides details about the vulnerability, its impact, and the recommended fix.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
