CVE-2018-7035: Gleez CMS Stored XSS
Summary
CVE-2018-7035: Gleez CMS Stored XSS. Affects gleez/cms versions < 1.2.0. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Gleez CMS is an open-source content management system that allows users to create and manage websites. It provides various features such as a WYSIWYG editor for creating and editing content. However, Gleez CMS versions 1.2.0 and 2.0 are vulnerable to a stored cross-site scripting (XSS) attack. This means that an attacker can inject malicious JavaScript code into the HTML content of an editor, which will be executed when an administrator tries to edit the same content. The vulnerability occurs when using the source editor in HTML mode during the Add Blog action.
Vulnerability Detail
The stored XSS vulnerability in Gleez CMS allows remote attackers to inject JavaScript code into the HTML content, which is then executed by administrators when they try to edit the same content. This can lead to various consequences, including unauthorized access to user data, session hijacking, and the potential for further exploitation of the affected system. The vulnerability has a CVSS score of 5.4, indicating a moderate severity level.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, administrators can disable the use of the source editor in HTML mode or restrict access to the affected functionality. This can help mitigate the risk of exploitation until a proper fix is implemented.
Conclusion
The stored XSS vulnerability in Gleez CMS can allow remote attackers to inject and execute malicious JavaScript code. To mitigate this risk, it is recommended to upgrade to the latest version of Gleez CMS that includes a patch for this vulnerability. Regularly updating the CMS and applying security patches is crucial to maintaining the security of your Gleez CMS installation. For further support on vulnerability remediation, contact DevNack.com.
See every vulnerability recorded for gleez/cms →
FAQ
Gleez CMS is an open-source content management system that allows users to create and manage websites.
A stored XSS vulnerability allows an attacker to inject malicious code into a web application, which is then executed by other users when they access the affected content.
An attacker can exploit this vulnerability by injecting JavaScript code into the HTML content of an editor in Gleez CMS. When an administrator tries to edit the same content, the injected code will be executed, potentially leading to unauthorized access or other malicious actions.
The impact of this vulnerability can vary depending on the attacker's intentions. It could lead to unauthorized access to user data, session hijacking, or further exploitation of the affected system.
To protect your Gleez CMS installation, it is important to keep the CMS and any plugins or themes up to date with the latest security patches. Regularly check for updates and apply them as soon as they become available.
References
Related vulnerabilities
Recent vulnerabilities recorded for gleez/cms.
