CVE-2024-1529: Cross-site Scripting in CMS Made Simple

Published Mar 12, 2024

Updated

Vulnerability in CMS Made Simple 2.2.14, which does not sufficiently encode user-controlled input, resulting in a Cross-Site Scripting (XSS) vulnerability through /admin/adduser.php, in multiple parameters. This vulnerability could allow a remote attacker to send a specially crafted JavaScript payload to an authenticated user and partially take over their browser session.

Affected Software

2 affected components

CMS Made Simple CMS Made Simple

CMSmadesimple CMS Made Simple=2.2.14

Remediation

Information

There is no reported solution at this time.

Event History

Mar 12, 2024

CVE Published

via MITRE·03:25 PM

Data Sourced

via MITRE·03:25 PM

RemedyDescriptionSeverityWeakness

Data Sourced

via NVD·04:15 PM

DescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

What is the severity of CVE-2024-1529?

CVE-2024-1529 has a medium severity rating due to its potential for Cross-Site Scripting (XSS) attacks.

How do I fix CVE-2024-1529?

To fix CVE-2024-1529, update your CMS Made Simple to the latest version where the vulnerability is patched.

What impact does CVE-2024-1529 have on web applications?

CVE-2024-1529 can allow remote attackers to execute malicious scripts, compromising the security of web applications utilizing CMS Made Simple.

Which versions of CMS Made Simple are affected by CVE-2024-1529?

CVE-2024-1529 specifically affects CMS Made Simple version 2.2.14.

What are the primary attack vectors for CVE-2024-1529?

The primary attack vectors for CVE-2024-1529 are through user-controlled input in the /admin/adduser.php page.