Evolution CMS Cross-site Scripting Vulnerability in evolutioncms/evolution
Summary
CVE-2023-43340: Evolution CMS Cross-site Scripting vulnerability. Affects evolutioncms/evolution versions < 3.2.3. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Evolution CMS is an open-source content management system (CMS) designed for creating and managing websites. It provides a user-friendly interface and a range of features for website development. The evolutioncms/evolution package is a popular implementation of Evolution CMS. However, it has been found to be vulnerable to a cross-site scripting (XSS) attack.
Vulnerability Detail
The vulnerability, identified as GHSA-432f-967f-vxg4 (CVE-2023-43340), allows a local attacker to execute arbitrary code by injecting a crafted payload into the cmsadmin, cmsadminemail, cmspassword, and cmspasswordconfim parameters. This vulnerability can be exploited to perform various malicious activities, such as stealing sensitive information, modifying website content, or launching further attacks on users.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, developers can implement input validation and sanitization techniques to mitigate the risk of XSS attacks. This involves validating and filtering user input to remove any potentially malicious code. Additionally, implementing content security policies (CSP) can help prevent the execution of injected scripts.
Conclusion
The Evolution CMS package, specifically the evolutioncms/evolution implementation, is vulnerable to a cross-site scripting (XSS) attack. It is crucial for developers to update to the latest version of the package to fix this vulnerability. Implementing input validation, sanitization techniques, and content security policies can provide additional protection. For further assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for evolutioncms/evolution →
FAQ
Evolution CMS is an open-source content management system (CMS) used for creating and managing websites.
Cross-site scripting (XSS) is a type of security vulnerability that allows attackers to inject malicious scripts into web pages viewed by other users.
This vulnerability allows attackers to execute arbitrary code on Evolution CMS installations, potentially leading to unauthorized access, data theft, or website defacement.
Yes, updating the evolutioncms/evolution package to the latest version should address this vulnerability.
Implementing input validation and sanitization techniques, as well as content security policies (CSP), can help mitigate the risk of XSS attacks.
Related vulnerabilities
Recent vulnerabilities recorded for evolutioncms/evolution.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
