GHSA-545f-pgp7-fwjf

ghsaUSosv

Log value insertion in craftercms

view advisory published 2022-05-17Licence: CC-BY-4.0

An anonymous user can craft a URL with text that ends up in the log viewer as is. The text can then include textual messages to mislead the administrator.

describes (1)

Related CVEs.

ID	severity	EPSS	exploitable	published
CVE-2021-23266US	medium4.3	0.56% (47th)	—	2022-05-16
An anonymous user can craft a URL with text that ends up in the log viewer as is. The text can then include textual messages to mislead the administrator.

references

External citations — patches, advisories, analysis.

https://docs.craftercms.org/en/3.1/security/advisory.html#cv-2022051602WEB
https://nvd.nist.gov/vuln/detail/CVE-2021-23266ADVISORY

scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.

Free scan