CVE-2021-41169: Improper Neutralization HTML tags in sulu/sulu

Q: What is CVE-2021-41169?

CVE-2021-41169 is a vulnerability in the Sulu PHP content management system that allows for stored cross-site scripting attacks.

Q: How severe is CVE-2021-41169?

CVE-2021-41169 has a severity rating of medium with a CVSS score of 4.8.

Q: Which versions of Sulu are affected by CVE-2021-41169?

Versions of Sulu before 1.6.43 are affected by CVE-2021-41169.

Q: How does CVE-2021-41169 work?

CVE-2021-41169 occurs when HTML input into Tag names is not properly sanitized, allowing for stored cross-site scripting attacks.

Q: How can I fix CVE-2021-41169 in Sulu?

To fix CVE-2021-41169, users are advised to upgrade to Sulu version 1.6.43 or later.

Published Oct 21, 2021

Updated

Sulu is an open-source PHP content management system based on the Symfony framework. In versions before 1.6.43 are subject to stored cross site scripting attacks. HTML input into Tag names is not properly sanitized. Only admin users are allowed to create tags. Users are advised to upgrade.

Affected Software

1 affected component

Sulu Sulu<1.6.43

Remediation

Patch Available

https://github.com/sulu/sulu/commit/20007ac70a3af3c9e53a6acb0ef8794b65642445

Event History

Oct 21, 2021

CVE Published

via MITRE·08:25 PM

Data Sourced

via MITRE·08:25 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·09:15 PM

RemedyDescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

What is CVE-2021-41169?

CVE-2021-41169 is a vulnerability in the Sulu PHP content management system that allows for stored cross-site scripting attacks.

How severe is CVE-2021-41169?