CVE-2020-35241: XSS
Published Dec 30, 2020
·Updated
FlatPress 1.0.3 is affected by cross-site scripting (XSS) in the Blog Content component. This vulnerability can allow an attacker to inject the XSS payload in Blog content via the admin panel. Each time any user will go to that blog page, the XSS triggers and the attacker can steal the cookie according to the crafted payload.
Affected Software
1 affected component
flatpress flatpress=1.0.3
Event History
Dec 30, 2020
CVE Published
via MITRE·02:26 PM
Data Sourced
via MITRE·02:26 PM
Description
Data Sourced
via NVD·03:15 PM
DescriptionSeverityWeaknessAffected Software
Frequently Asked Questions
1
What is the severity of CVE-2020-35241?
CVE-2020-35241 has been classified as a medium severity vulnerability.
2
How do I fix CVE-2020-35241?
To fix CVE-2020-35241, upgrade FlatPress to the latest version that addresses this cross-site scripting vulnerability.
3
Who is affected by CVE-2020-35241?
Users of FlatPress version 1.0.3 are affected by CVE-2020-35241.
4
What type of vulnerability is CVE-2020-35241?
CVE-2020-35241 is a cross-site scripting (XSS) vulnerability.
5
Can CVE-2020-35241 allow cookie theft?
Yes, CVE-2020-35241 can allow an attacker to steal cookies through the XSS payload.