CVE-2021-25977: Piranha CMS - Stored XSS in Page Title
Published Oct 25, 2021
·Updated
In PiranhaCMS, versions 7.0.0 to 9.1.1 are vulnerable to stored XSS due to the page title improperly sanitized. By creating a page with a specially crafted page title, a low privileged user can trigger arbitrary JavaScript execution.
Affected Software
1 affected component
Dotnetfoundation Piranha Cms>=7.0.0<=9.1.1
Remediation
Information
Update to 9.2.0
Event History
Oct 25, 2021
CVE Published
via MITRE·01:10 PM
Data Sourced
via MITRE·01:10 PM
RemedyDescriptionSeverityWeakness
Frequently Asked Questions
1
What is the severity of CVE-2021-25977?
CVE-2021-25977 has a low severity rating due to its exploitation requiring a low privileged user.
2
How do I fix CVE-2021-25977?
To fix CVE-2021-25977, upgrade PiranhaCMS to a version after 9.1.1 where the vulnerability is patched.
3
Who is affected by CVE-2021-25977?
CVE-2021-25977 affects users of PiranhaCMS versions from 7.0.0 to 9.1.1.
4
What is stored XSS as described in CVE-2021-25977?
Stored XSS in CVE-2021-25977 allows an attacker to execute arbitrary JavaScript by entering a malicious page title.
5
What actions can an affected user take in response to CVE-2021-25977?
Affected users should immediately upgrade their PiranhaCMS installations to prevent potential exploitation.