GHSA-x8wj-cqmp-3wmm

Source

https://github.com/advisories/GHSA-x8wj-cqmp-3wmm

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/03/GHSA-x8wj-cqmp-3wmm/GHSA-x8wj-cqmp-3wmm.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-x8wj-cqmp-3wmm

Aliases

CVE-2021-41952

Published

2022-03-15T00:00:59Z

Modified

2023-11-08T04:07:03Z

Severity

4.8 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N CVSS Calculator

Summary

Cross-site Scripting in Zenario CMS

Details

Zenario CMS 9.0.54156 is vulnerable to Cross Site Scripting (XSS) via upload file to *.SVG. An attacker can send malicious files to victims and steals victim's cookie leads to account takeover. The person viewing the image of a contact can be victim of XSS.

Database specific

{
    "cwe_ids":  [
        "CWE-79"
    ],
    "github_reviewed":  true,
    "github_reviewed_at":  "2022-03-28T22:21:45Z",
    "nvd_published_at":  "2022-03-14T15:15:00Z",
    "severity":  "MODERATE"
}

References

Affected packages

Packagist / tribalsystems/zenario

Package

Name: tribalsystems/zenario
Purl: pkg:composer/tribalsystems/zenario

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

9.0.55143

Affected versions

7.*

7.5.40440

7.5.41006

7.5.41499

7.5.41633

7.5.42085

7.5.42990

7.5.47180

7.6.41504

7.6.41633

7.6.42085

7.6.42990

7.6.47180

7.7.42682

7.7.42963

7.7.42990

7.7.44223

7.7.47180

7.7.47369

7.7.48583

8.*

8.0.44237

8.0.44273

8.0.44294

8.0.44521

8.0.45032

8.0.45250

8.0.45529

8.0.47180

8.0.48583

8.1.45530

8.1.45698

8.1.46089

8.1.46433

8.1.46615

8.1.47180

8.1.47369

8.1.48583

8.2.46436

8.2.46614

8.2.47180

8.2.47369

8.2.47992

8.2.48583

8.3.47997

8.3.48583

8.3.50564

8.4.50565

8.4.51340

8.5.50567

8.5.50837

8.5.51340

8.6.51342

8.7

8.8

8.8.53370

8.8.53725

8.8.54063

8.9.54063

8.9.54149

8.9.54153

8.9.55141

9.*

9.0.54156

9.0.55141

Database specific

last_known_affected_version_range

"<= 9.0.54156"

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/03/GHSA-x8wj-cqmp-3wmm/GHSA-x8wj-cqmp-3wmm.json"