Lucene search

GitHub_MCVE-2021-41169

HistoryOct 21, 2021 - 9:15 p.m.

CVE-2021-41169

2021-10-2121:15:08

CWE-79

GitHub_M

web.nvd.nist.gov

sulu

cms

php

symfony

cve-2021-41169

xss

vulnerability

upgrade

CVSS2

3.5

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

SINGLE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:S/C:N/I:P/A:N

CVSS3

6.2

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:N/A:N

AI Score

4.7

Confidence

High

EPSS

0.001

Percentile

19.4%

JSON

Sulu is an open-source PHP content management system based on the Symfony framework. In versions before 1.6.43 are subject to stored cross site scripting attacks. HTML input into Tag names is not properly sanitized. Only admin users are allowed to create tags. Users are advised to upgrade.

Affected configurations

Nvd

Vulners

Node

sulusuluRange<1.6.43

VendorProductVersionCPE
sulusulu*cpe:2.3:a:sulu:sulu:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
sulu	sulu	*	cpe:2.3:a:sulu:sulu::::::::

CNA Affected

[
  {
    "product": "sulu",
    "vendor": "sulu",
    "versions": [
      {
        "status": "affected",
        "version": "< 1.6.43"
      }
    ]
  }
]

References

github.com/sulu/sulu/commit/20007ac70a3af3c9e53a6acb0ef8794b65642445

github.com/sulu/sulu/security/advisories/GHSA-h58v-g3q6-q9fx

CVSS2

3.5

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

SINGLE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:S/C:N/I:P/A:N

CVSS3

6.2

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:N/A:N

AI Score

4.7

Confidence

High

EPSS

0.001

Percentile

19.4%

JSON

Related for CVE-2021-41169