CVE-2021-25894: XSS
Published Apr 2, 2021
·Updated
Magnolia CMS from 6.1.3 to 6.2.3 contains a stored cross-site scripting (XSS) vulnerability in the /magnoliaPublic/travel/members/login.html mgnlUserId parameter.
Affected Software
2 affected components
Magnolia-cms Magnolia Cms>=6.1.3<6.1.7
Magnolia-cms Magnolia Cms>=6.2.3<6.2.4
Remediation
Event History
Apr 2, 2021
CVE Published
via MITRE·11:31 AM
Data Sourced
via MITRE·11:31 AM
Description
Frequently Asked Questions
1
What is the severity of CVE-2021-25894?
CVE-2021-25894 is classified as a moderate severity vulnerability due to its potential to allow stored cross-site scripting (XSS).
2
How do I fix CVE-2021-25894?
To mitigate CVE-2021-25894, update Magnolia CMS to version 6.2.4 or later, which addresses the vulnerability.
3
What systems are affected by CVE-2021-25894?
CVE-2021-25894 affects Magnolia CMS versions from 6.1.3 to 6.2.3.
4
Is CVE-2021-25894 a critical vulnerability?
CVE-2021-25894 is not classified as critical, but it poses a significant risk due to stored XSS capabilities.
5
Can CVE-2021-25894 be exploited remotely?
Yes, CVE-2021-25894 can be exploited remotely by attackers through the affected login page.