CVE-2024-34460: Cross-site Scripting in Zenario's Tree Explorer Tool from Organizer
Summary
CVE-2024-34460: Zenario's Tree Explorer tool from Organizer affected by Cross-site Scripting. Affects tribalsystems/zenario versions < 9.5.60602. Fixed in 9.5.60602. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Zenario is an open-source content management system (CMS) developed by Tribal Systems. It provides a platform for creating and managing websites with various features such as content organization, user management, and customizable templates. The Tree Explorer tool from Organizer is a component in Zenario that allows users to navigate and manage the website's content hierarchy. Unfortunately, versions of Zenario before 9.5.60602 are vulnerable to cross-site scripting (XSS) attacks through the Tree Explorer tool.
Vulnerability Detail
The XSS vulnerability in Zenario's Tree Explorer tool allows an attacker to inject malicious scripts into the web application, which are then executed by unsuspecting users. This can lead to various security risks, including unauthorized access to sensitive information, session hijacking, and defacement of the website. The vulnerability was addressed and removed in version 9.5.60602 of Zenario.
How To Fix
Minimum fixed version
9.5.60602
This is the first release that contains the fix.
composer require tribalsystems/zenario:9.5.60602Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Conclusion
The XSS vulnerability in Zenario's Tree Explorer tool poses a moderate security risk to websites using affected versions of Zenario. It is crucial for users to update their installations to Zenario version 9.5.60602 or later to ensure the security of their websites. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for tribalsystems/zenario →
FAQ
Zenario is an open-source content management system (CMS) developed by Tribal Systems. It provides a platform for creating and managing websites with various features such as content organization, user management, and customizable templates.
The Tree Explorer tool from Organizer is a component in Zenario that allows users to navigate and manage the website's content hierarchy.
Cross-site scripting (XSS) is a type of security vulnerability that allows attackers to inject malicious scripts into web pages viewed by other users. These scripts can be used to steal sensitive information, manipulate website content, or perform unauthorized actions on behalf of the user.
The XSS vulnerability in Zenario's Tree Explorer tool can lead to various security risks, including unauthorized access to sensitive information, session hijacking, and defacement of the website.
To fix the XSS vulnerability, it is recommended to upgrade to Zenario version 9.5.60602 or later, as this version includes the necessary security patches to mitigate the vulnerability.
Related vulnerabilities
Recent vulnerabilities recorded for tribalsystems/zenario.
