CVE-2020-37238: CMS Made Simple 2.2.15 Stored XSS via SVG File Upload
CMS Made Simple 2.2.15 contains a stored cross-site scripting vulnerability that allows authenticated users with Content Manager access to inject malicious scripts through SVG file uploads. Attackers can upload SVG files containing embedded JavaScript to the file manager, which executes when other authenticated users access the uploaded file, enabling cookie theft and session hijacking.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2020-37238?
CVE-2020-37238 has a medium severity due to its potential for stored cross-site scripting attacks.
Who is affected by CVE-2020-37238?
CVE-2020-37238 affects authenticated users with Content Manager access on CMS Made Simple version 2.2.15.
How do I fix CVE-2020-37238?
To fix CVE-2020-37238, upgrade CMS Made Simple to the latest version to mitigate the stored XSS vulnerability.
What types of attacks can CVE-2020-37238 facilitate?
CVE-2020-37238 can facilitate stored XSS attacks, allowing attackers to execute malicious scripts on affected user browsers.
Is CVE-2020-37238 specific to SVG file uploads?
Yes, CVE-2020-37238 specifically involves vulnerabilities related to SVG file uploads in CMS Made Simple.