CVE-2024-45960: Zenario PDF Upload Vulnerability Leading to XSS Attacks
Summary
CVE-2024-45960: Zenario allows authenticated admin users to upload PDF files containing malicious code. Affects tribalsystems/zenario versions < 9.7.61188. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Zenario is a content management system (CMS) designed for building and managing websites. It offers a range of features including customizable templates, user management, and multimedia support. However, in version 9.7.61188, Zenario allows authenticated admin users to upload PDF files, which can potentially contain malicious code, exposing the system to security risks.
Vulnerability Detail
The vulnerability arises from the improper handling of PDF file uploads by authenticated admin users in Zenario 9.7.61188. This flaw allows the upload of PDFs that can contain malicious scripts. When these files are accessed through the website, they can execute Cross Site Scripting (XSS) attacks, compromising the security of the application and potentially leading to unauthorized access or data manipulation.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, restrict the ability of authenticated admin users to upload PDF files until a patch is applied. Additionally, implement input validation and sanitization for uploaded files to prevent the execution of malicious scripts.
Conclusion
The vulnerability identified as CVE-2024-45960 in Zenario poses a significant risk due to the ability of authenticated admin users to upload malicious PDF files. It is crucial to upgrade to a secure version and implement necessary workarounds to protect your system from potential XSS attacks.
See every vulnerability recorded for tribalsystems/zenario →
FAQ
CVE-2024-45960 is a vulnerability in Zenario that allows authenticated admin users to upload malicious PDF files, potentially leading to XSS attacks.
If you are using Zenario version 9.7.61188 or earlier, your installation is vulnerable. You can check your version in the admin panel.
The risks include unauthorized access to sensitive data, manipulation of website content, and potential compromise of user accounts through XSS attacks.
Yes, you can use Vulert to monitor your application for open-source vulnerabilities in real-time. It analyzes your composer.lock file to provide alerts.
If immediate upgrading is not possible, implement strict file upload controls and validate the content of uploaded files to mitigate risks.
Related vulnerabilities
Recent vulnerabilities recorded for tribalsystems/zenario.
