Lucene search

GoogleOSV:GHSA-34J6-M83C-52X2

HistoryAug 26, 2022 - 12:03 a.m.

Jfinal Cross-site Scripting vulnerability

2022-08-2600:03:30

Google

osv.dev

jfinal cms

cross-site scripting

vulnerability

blog post

5.4 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

0.001 Low

EPSS

Percentile

25.0%

JSON

Jfinal CMS v5.1.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the post title text field under the publish blog module.

CPENameOperatorVersion
com.jflyfox:jflyfox_jfinaleq1.9
com.jflyfox:jflyfox_jfinaleq4.4
com.jflyfox:jflyfox_jfinaleq1.8
com.jflyfox:jflyfox_jfinaleq3.0
com.jflyfox:jflyfox_jfinaleq4.2
com.jflyfox:jflyfox_jfinaleq4.1
com.jflyfox:jflyfox_jfinaleq2.1
com.jflyfox:jflyfox_jfinaleq2.0
com.jflyfox:jflyfox_jfinaleq4.0
com.jflyfox:jflyfox_jfinaleq4.3

Name	Operator	Version
com.jflyfox:jflyfox_jfinal	eq	1.9
com.jflyfox:jflyfox_jfinal	eq	4.4
com.jflyfox:jflyfox_jfinal	eq	1.8
com.jflyfox:jflyfox_jfinal	eq	3.0
com.jflyfox:jflyfox_jfinal	eq	4.2
com.jflyfox:jflyfox_jfinal	eq	4.1
com.jflyfox:jflyfox_jfinal	eq	2.1
com.jflyfox:jflyfox_jfinal	eq	2.0
com.jflyfox:jflyfox_jfinal	eq	4.0
com.jflyfox:jflyfox_jfinal	eq	4.3

Rows per page:

1-10 of 111

References

github.com/jflyfox/jfinal_cms/issues/45

github.com/jflyfox/jflyfox_jfinal

nvd.nist.gov/vuln/detail/CVE-2022-36527