CVE-2022-40849: XSS
ThinkCMF version 6.0.7 is affected by Stored Cross-Site Scripting (XSS). An attacker who successfully exploited this vulnerability could inject a Persistent XSS payload in the Slideshow Management section that execute arbitrary JavaScript code on the client side, e.g., to steal the administrator's PHP session token (PHPSESSID).
Affected Software
Event History
Frequently Asked Questions
What is the vulnerability ID for this vulnerability?
The vulnerability ID for this vulnerability is CVE-2022-40849.
What is the severity of CVE-2022-40849?
The severity of CVE-2022-40849 is medium with a CVSS score of 5.4.
How does CVE-2022-40849 affect ThinkCMF?
CVE-2022-40849 affects ThinkCMF version 6.0.7.
What is the impact of CVE-2022-40849?
The impact of CVE-2022-40849 is that an attacker can inject a Persistent XSS payload in the Slideshow Management section, allowing them to execute arbitrary JavaScript code on the client side.
How can CVE-2022-40849 be fixed?
To fix CVE-2022-40849, it is recommended to update ThinkCMF to a version that has the security vulnerability patched.