CVE-2019-20789: Cross-site scripting in Croogo
Summary
CVE-2019-20789: Croos-site scripting in Croogo. Affects croogo/croogo versions < 3.0.7. Fixed in 3.0.7. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Croogo is a content management system (CMS) built on top of the CakePHP framework. It provides a flexible and extensible platform for creating websites and web applications. Croogo allows users to manage menus and taxonomies, among other features. However, versions before 3.0.7 are vulnerable to a cross-site scripting (XSS) attack.
Vulnerability Detail
The vulnerability (CVE-2019-20789) in Croogo allows an attacker to execute malicious scripts in a victim's browser. This can occur when the title parameter is not properly sanitized in the admin/menus/menus or admin/taxonomy/vocabularies endpoints. By injecting malicious code into the title field, an attacker can trick users into executing unintended actions or stealing sensitive information. The impact of this vulnerability is considered low, with a CVSS score of 4.8.
How To Fix
Minimum fixed version
3.0.7
This is the first release that contains the fix.
composer require croogo/croogo:3.0.7Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading to the latest version is not immediately possible, a temporary workaround is to manually sanitize the title parameter before it is used in the affected endpoints. This can be done by implementing input validation and output encoding to prevent the execution of malicious scripts. Here is an example of how to sanitize the title parameter in PHP:
$title = htmlspecialchars($_POST['title'], ENT_QUOTES, 'UTF-8');
Conclusion
In conclusion, Croogo versions before 3.0.7 are vulnerable to a cross-site scripting (XSS) attack. The vulnerability allows attackers to execute malicious scripts in a victim's browser by injecting them into the title parameter of the admin/menus/menus or admin/taxonomy/vocabularies endpoints. To mitigate this vulnerability, it is recommended to upgrade to version 3.0.7 or later of Croogo. If immediate upgrading is not possible, implementing input validation and output encoding can serve as a temporary workaround. For further assistance and support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for croogo/croogo →
FAQ
Croogo is a content management system (CMS) built on top of the CakePHP framework. It provides a flexible and extensible platform for creating websites and web applications.
Cross-site scripting (XSS) is a type of security vulnerability that allows attackers to inject malicious scripts into web pages viewed by other users. This can lead to the execution of unintended actions or the theft of sensitive information.
The impact of this vulnerability is considered low, with a CVSS score of 4.8. However, it can still be exploited by attackers to execute malicious scripts in a victim's browser and potentially perform unauthorized actions or steal sensitive information.
To fix this vulnerability, it is recommended to upgrade to version 3.0.7 or later of Croogo. This version includes a fix for the XSS vulnerability by properly sanitizing the title parameter. Upgrading can be done by following the upgrade instructions provided by the Croogo project.
If upgrading to the latest version is not immediately possible, a temporary workaround is to manually sanitize the title parameter before it is used in the affected endpoints. This can be done by implementing input validation and output encoding to prevent the execution of malicious scripts.
References
Related vulnerabilities
Recent vulnerabilities recorded for croogo/croogo.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
