GHSA-jvjp-vh27-r9h5

Cross-site Scripting in PiranhaCMS

Source: GitHub Advisory Database (reviewed) Moderate CVE-2021-25977

Packages

Ecosystem	Package	Affected	Fixed in
NuGet	Piranha	>= 7.0.0, < 9.2.0	9.2.0

Details

As written in the advisory (Markdown source, shown as plain text).

In PiranhaCMS, versions 7.0.0 to 9.1.1 are vulnerable to stored XSS due to the page title improperly sanitized. By creating a page with a specially crafted page title, a low privileged user can trigger arbitrary JavaScript execution.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2021-25977 advisory
https://github.com/PiranhaCMS/piranha.core/commit/543bc53c7dbd28c793ec960b57fb0e716c6b18d7 web
https://github.com/PiranhaCMS/piranha.core package
https://www.whitesourcesoftware.com/vulnerability-database/CVE-2021-25977 web