CVE-2021-27237: XSS
Published Feb 16, 2021
·Updated
The admin panel in BlackCat CMS 1.3.6 allows stored XSS (by an admin) via the Display Name field to backend/preferences/ajaxsave.php.
Affected Software
1 affected component
Blackcat-cms Blackcat Cms=1.3.6
Remediation
Event History
Feb 16, 2021
CVE Published
via MITRE·06:23 PM
Data Sourced
via MITRE·06:23 PM
Description
Frequently Asked Questions
1
What is the severity of CVE-2021-27237?
CVE-2021-27237 has a high severity rating due to the potential for stored cross-site scripting (XSS) attacks.
2
How do I fix CVE-2021-27237?
To fix CVE-2021-27237, upgrade your BlackCat CMS to version 1.4 or later.
3
What is stored XSS in the context of CVE-2021-27237?
Stored XSS occurs when malicious scripts are injected into the website's database and executed in the browser of an unsuspecting user.
4
Who is affected by CVE-2021-27237?
Administrators using BlackCat CMS version 1.3.6 are particularly affected by CVE-2021-27237.
5
Are there any workarounds for CVE-2021-27237 if I can't upgrade immediately?
Implementing input validation and sanitization on the Display Name field may serve as a temporary workaround for CVE-2021-27237.