Cross-site Scripting in Zenario CMS

2022-03-1500:00:59

Google

osv.dev

0.001 Low

EPSS

Percentile

24.9%

JSON

Zenario CMS 9.0.54156 is vulnerable to Cross Site Scripting (XSS) via upload file to *.SVG. An attacker can send malicious files to victims and steals victim’s cookie leads to account takeover. The person viewing the image of a contact can be victim of XSS.

CPENameOperatorVersion
tribalsystems/zenarioeq7.7.47369
tribalsystems/zenarioeq7.7.48583
tribalsystems/zenarioeq8.1.46433
tribalsystems/zenarioeq8.0.47180
tribalsystems/zenarioeq7.6.47180
tribalsystems/zenarioeq7.7.47180
tribalsystems/zenarioeq8.0.44273
tribalsystems/zenarioeq8.2.47369
tribalsystems/zenarioeq8.4.51340
tribalsystems/zenarioeq8.8.53725

Name	Operator	Version
tribalsystems/zenario	eq	7.7.47369
tribalsystems/zenario	eq	7.7.48583
tribalsystems/zenario	eq	8.1.46433
tribalsystems/zenario	eq	8.0.47180
tribalsystems/zenario	eq	7.6.47180
tribalsystems/zenario	eq	7.7.47180
tribalsystems/zenario	eq	8.0.44273
tribalsystems/zenario	eq	8.2.47369
tribalsystems/zenario	eq	8.4.51340
tribalsystems/zenario	eq	8.8.53725