GHSA-63c6-w556-3h7q

SSCMS vulnerable to Cross Site Scripting

Source: GitHub Advisory Database (reviewed) Moderate CVE-2023-2862

Packages

Ecosystem	Package	Affected	Fixed in
NuGet	SSCMS	<= 7.2.1	no fix listed

Details

As written in the advisory (Markdown source, shown as plain text).

A vulnerability, which was classified as problematic, was found in SiteServer CMS up to 7.2.1. Affected is an unknown function of the file `/api/stl/actions/search`. The manipulation of the argument ajaxDivId leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. It is recommended to apply a patch to fix this issue. VDB-229818 is the identifier assigned to this vulnerability.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2023-2862 advisory
https://gitee.com/siteserver/cms package
https://gitee.com/siteserver/cms/issues/I71WJ4 web
https://vuldb.com/?ctiid.229818 web
https://vuldb.com/?id.229818 web