GHSA-mmx8-vrfg-hfmq

Piranha CMS Cross-site Scripting vulnerability

Source: GitHub Advisory Database (reviewed) Moderate CVE-2024-55341

Packages

Ecosystem	Package	Affected	Fixed in
NuGet	Piranha	<= 11.1.0	no fix listed

Details

As written in the advisory (Markdown source, shown as plain text).

A stored cross-site scripting (XSS) vulnerability in Piranha CMS 11.1 allows remote attackers to execute arbitrary JavaScript in the web browser of a user, by creating a page via the /manager/pages and then adding a markdown content with the XSS payload.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2024-55341 advisory
https://github.com/PiranhaCMS/piranha.core package
https://sec-fortress.github.io/posts/articles/posts/CVE-2024-55341.html web