Duplicate Advisory: Kirby CMS vulnerable to self cross-site scripting (self-XSS) in the URL field
Summary
GHSA-w879-mxj5-c3wf: Duplicate Advisory: Kirby vulnerable to self cross-site scripting (self-XSS) in the URL field. Affects getkirby/cms versions < 4.1.1. Fixed in 4.1.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Kirby CMS is a popular content management system used for building websites. It provides a flexible and easy-to-use interface for managing website content. However, version 4.1.0 of Kirby CMS has been found to contain a vulnerability that allows for self cross-site scripting (self-XSS) attacks through the URL parameter.
Vulnerability Detail
The vulnerability in Kirby CMS version 4.1.0 is a reflected cross-site scripting (XSS) issue. Attackers can exploit this vulnerability by injecting malicious code into the URL parameter, which is then reflected back to users when they visit the affected page. This can lead to the execution of arbitrary JavaScript code in the context of the victim's browser, potentially allowing for session hijacking, defacement, or other malicious activities.
How To Fix
Minimum fixed version
4.1.1
This is the first release that contains the fix.
composer require getkirby/cms:4.1.1Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is recommended to upgrade to the latest version of Kirby CMS as soon as possible.
Conclusion
In conclusion, Kirby CMS version 4.1.0 is vulnerable to a self cross-site scripting (self-XSS) issue that can be exploited by injecting malicious code into the URL parameter. Users should upgrade to version 4.1.1 or later to fix this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for getkirby/cms →
FAQ
Kirby CMS is a content management system used for building websites. It provides an intuitive interface for managing website content.
Cross-site scripting (XSS) is a type of security vulnerability that allows attackers to inject malicious scripts into web pages viewed by other users.
The self-XSS vulnerability in Kirby CMS allows attackers to inject malicious code into the URL parameter, which is then reflected back to users when they visit the affected page.
The self-XSS vulnerability in Kirby CMS can lead to the execution of arbitrary JavaScript code in the victim's browser, potentially enabling session hijacking, defacement, or other malicious activities.
To protect your Kirby CMS installation, it is recommended to upgrade to the latest version (4.1.1 or later) which includes a patch for the self-XSS vulnerability.
Related vulnerabilities
Recent vulnerabilities recorded for getkirby/cms.
