CVE-2020-36408: XSS

Published Jul 2, 2021

Updated

A stored cross scripting (XSS) vulnerability in CMS Made Simple 2.2.14 allows authenticated attackers to execute arbitrary web scripts or HTML via a crafted payload entered into the "Add Shortcut" parameter under the "Manage Shortcuts" module.

Affected Software

1 affected component

CMSmadesimple CMS Made Simple=2.2.14

Event History

Jul 2, 2021

CVE Published

via MITRE·05:51 PM

Data Sourced

via MITRE·05:51 PM

Description

Frequently Asked Questions

What is the severity of CVE-2020-36408?

The severity of CVE-2020-36408 is medium with a CVSS score of 5.4.

How does the stored cross scripting (XSS) vulnerability in CMS Made Simple 2.2.14 impact users?

The vulnerability allows authenticated attackers to execute arbitrary web scripts or HTML, potentially compromising the security and integrity of the website.

How can an attacker exploit the stored cross scripting (XSS) vulnerability in CMS Made Simple 2.2.14?

An attacker can exploit the vulnerability by entering a crafted payload into the "Add Shortcut" parameter under the "Manage Shortcuts" module.

Is there a fix available for CVE-2020-36408?

Yes, upgrading CMS Made Simple to a version beyond 2.2.14 will fix the vulnerability.

Where can I find more information about CVE-2020-36408?

You can find more information about CVE-2020-36408 on the CMS Made Simple bug tracker at http://dev.cmsmadesimple.org/bug/view/12325.