Lucene search

GitHub Advisory DatabaseGHSA-RVJP-J5J4-C9J5

HistoryAug 11, 2023 - 3:30 p.m.

Gila CMS Cross-site Scripting Vulnerability

2023-08-1115:30:45

CWE-79

GitHub Advisory Database

github.com

cross site scripting

adm_user parameter

arbitrary code execution

gila cms installation

CVSS3

6.1

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

EPSS

0.001

Percentile

42.5%

JSON

Cross Site Scripting (XSS) vulnerability in adm_user parameter in Gila CMS version 1.11.3, allows remote attackers to execute arbitrary code during the Gila CMS installation.

Affected configurations

Vulners

Node

gilacmsgila_cmsRange≤1.11.3

VendorProductVersionCPE
gilacmsgila_cms*cpe:2.3:a:gilacms:gila_cms:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
gilacms	gila_cms	*	cpe:2.3:a:gilacms:gila_cms::::::::

References

github.com/advisories/GHSA-rvjp-j5j4-c9j5

github.com/GilaCMS/gila/issues/41

nvd.nist.gov/vuln/detail/CVE-2020-20523

CVSS3

6.1

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

EPSS

0.001

Percentile

42.5%

JSON

Related for GHSA-RVJP-J5J4-C9J5