GHSA-825g-f3g2-6vxf

QuickApps CMS Cross-site Scripting

Source: GitHub Advisory Database (reviewed) Moderate CVE-2017-1000495

Packages

Ecosystem	Package	Affected	Fixed in
Packagist	quickapps/cms	< 2.0.0	2.0.0

Details

As written in the advisory (Markdown source, shown as plain text).

QuickApps CMS version 2.0.0 is vulnerable to Stored Cross-site Scripting in the user's real name field resulting in denial of service and performing unauthorised actions with an administrator user's account

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2017-1000495 advisory
https://github.com/quickapps/cms/issues/183 web
https://github.com/quickapps/cms/commit/7d648f21bd87af8263dcd6449f0946a2dd31348a web
https://github.com/quickapps/cms package