CVE-2019-15228 - FUEL CMS 1.4.4 has XSS in the Create Blocks section of the Admin console

Back Back to CVE browser

MEDIUM

FUEL CMS 1.4.4 has XSS in the Create Blocks section of the Admin console

Published Aug 19, 2019

5.4

MEDIUM

CVSS 3.0

EPSS 0.73%

Description

FUEL CMS 1.4.4 has XSS in the Create Blocks section of the Admin console. This could lead to cookie stealing and other malicious actions. This vulnerability can be exploited with an authenticated account but can also impact unauthenticated visitors.

Affected products

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-79

Cross-site Scripting (XSS)

References (2)

https://github.com/daylightstudio/FUEL-CMS/issues/536
x_refsource_MISCExploitThird Party Advisory
https://www.sevenlayers.com/index.php/237-fuelcms-1-4-4-xss
x_refsource_MISCExploitThird Party Advisory

Link	Providers	Tags
https://github.com/daylightstudio/FUEL-CMS/issues/536		x_refsource_MISCExploitThird Party Advisory
https://www.sevenlayers.com/index.php/237-fuelcms-1-4-4-xss		x_refsource_MISCExploitThird Party Advisory