CVE-2024-25875: Enhavo CMS v0.13.1 - Cross-site Scripting Vulnerability
Summary
CVE-2024-25875: Enhavo Cross-site Scripting vulnerability. Affects enhavo/enhavo-app versions < 0.13.1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Enhavo CMS is a content management system that allows users to create and manage websites. It provides various modules and features for easy customization and content creation. The Header module in Enhavo CMS v0.13.1 is vulnerable to a cross-site scripting (XSS) attack. This vulnerability can be exploited by injecting a crafted payload into the Undertitle text field, allowing attackers to execute arbitrary web scripts or HTML.
Vulnerability Detail
The cross-site scripting (XSS) vulnerability in the Header module of Enhavo CMS v0.13.1 enables attackers to inject malicious scripts or HTML code into the Undertitle text field. When this vulnerable code is rendered in a user's browser, the injected payload is executed, potentially leading to unauthorized actions, data theft, or further attacks. The Undertitle text field does not properly sanitize user input, allowing the execution of arbitrary code. This vulnerability has a moderate severity rating (CWE-79).
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, users can disable the use of the Header module or restrict access to the Undertitle text field. By removing or limiting the ability to input data into the vulnerable field, the risk of exploitation can be mitigated. However, this is not a permanent solution, and it is still recommended to update to a patched version of Enhavo CMS.
Conclusion
The cross-site scripting vulnerability in Enhavo CMS v0.13.1 can be exploited by injecting a crafted payload into the Undertitle text field. To mitigate this vulnerability, it is crucial to update Enhavo CMS to a version that includes a fix for this issue. Regularly updating software is essential to ensure the latest security patches are applied. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for enhavo/enhavo-app →
FAQ
Enhavo CMS is a content management system that allows users to create and manage websites. It provides various modules and features for easy customization and content creation.
Cross-site scripting (XSS) is a type of security vulnerability that allows attackers to inject malicious scripts or HTML code into web pages viewed by other users. This can lead to unauthorized actions, data theft, or further attacks.
This vulnerability in Enhavo CMS v0.13.1 allows attackers to execute arbitrary web scripts or HTML in the user's browser. This can lead to unauthorized actions, data theft, or further attacks.
To fix this vulnerability, it is recommended to upgrade Enhavo CMS to a version that includes a patch for this issue. The developers have released a fix in a subsequent version.
As a temporary workaround, users can disable the use of the Header module or restrict access to the Undertitle text field. However, it is still recommended to update to a patched version of Enhavo CMS.
Related vulnerabilities
Recent vulnerabilities recorded for enhavo/enhavo-app.
