CVE-2021-23260: Stored XSS Vulnerability in File Name of the File Upload function
Authenticated users with Site roles may inject XSS scripts via file names that will execute in the browser for this and other users of the same site.
Affected Software
Event History
Frequently Asked Questions
What is CVE-2021-23260?
CVE-2021-23260 is a vulnerability that allows authenticated users with Site roles to inject XSS scripts via file names, which can be executed in the browser for this user and other users of the same site.
How does CVE-2021-23260 affect Crafter CMS?
CVE-2021-23260 affects Crafter CMS versions between 3.1.0 and 3.1.12 where authenticated users with Site roles can inject XSS scripts using file names.
What is the severity of CVE-2021-23260?
The severity of CVE-2021-23260 is medium (CVSS score 5.4).
How can I fix CVE-2021-23260?
To fix CVE-2021-23260, it is recommended to upgrade Crafter CMS to a version higher than 3.1.12.
What is CWE-79?
CWE-79 is a Common Weakness Enumeration category for Cross-Site Scripting (XSS) vulnerabilities.