CVE-2020-22765: NukeViet Cross-site Scripting via the editor in the News module
Summary
CVE-2020-22765: NukeViet Cross-site Scripting via the editor in the News module. Affects nukeviet/nukeviet versions >= 4.4.0, < 4.4.01. Fixed in 4.4.01. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
NukeViet CMS is an open-source content management system (CMS) designed for building and managing websites. It provides various modules, including the News module, which allows users to create and publish news articles. The CMS is written in PHP and is widely used by developers and website administrators. However, version 4.4.0 of NukeViet CMS is vulnerable to a Cross-Site Scripting (XSS) attack through the editor in the News module.
Vulnerability Detail
The vulnerability in NukeViet CMS 4.4.0 allows an attacker to inject malicious scripts into the website's content through the editor in the News module. This can lead to the execution of arbitrary code in the context of the user's browser, potentially compromising the confidentiality and integrity of user data. The vulnerability is classified as moderate severity with a CVSS score of 6.1. The Common Weakness Enumeration (CWE) identifier for this vulnerability is CWE-79.
How To Fix
Minimum fixed version
4.4.01
This is the first release that contains the fix.
composer require nukeviet/nukeviet:4.4.01Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading to the latest version is not immediately feasible, a temporary workaround is to disable the editor in the News module or implement additional input sanitization measures to prevent the execution of malicious scripts. However, it is strongly advised to upgrade to the latest version as soon as possible to fully address the vulnerability.
Conclusion
The Cross-Site Scripting (XSS) vulnerability in NukeViet CMS 4.4.0 through the editor in the News module can lead to the execution of arbitrary code in the user's browser. It is crucial for website administrators to upgrade to version 4.4.01 or later to mitigate this vulnerability. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for nukeviet/nukeviet →
FAQ
NukeViet CMS is an open-source content management system (CMS) used for building and managing websites.
The News module is a component of NukeViet CMS that allows users to create and publish news articles on their websites.
Cross-Site Scripting (XSS) is a type of security vulnerability that allows attackers to inject malicious scripts into web pages viewed by other users.
This vulnerability allows an attacker to execute arbitrary code in the context of a user's browser, potentially compromising the confidentiality and integrity of user data.
To fix this vulnerability, it is recommended to upgrade to version 4.4.01 of NukeViet CMS or later.
References
Related vulnerabilities
Recent vulnerabilities recorded for nukeviet/nukeviet.
