CVE Vulnerability

CVE-2018-11512

Stored cross-site scripting (XSS) vulnerability in the "Website's name" field found in the "Settings" page under the "General" menu in Creatiwity wityCMS 0.6.1 allows remote attackers to inject arbitrary web script or HTML via a crafted website name by doing an authenticated POST HTTP request to admin/settings/general.

3.5 /10

CVSS v2.0 :

V3 Legend

Vector :

Exploitability : 6.8 / Impact : 2.9

Attack Vector

Attack Complexity

Privileges Required

User Interaction

Confidentiality Impact NONE

Integrity Impact PARTIAL

Availability Impact NONE

Scope

4.8 /10

CVSS v3.0 : MEDIUM

V3 Legend

Vector :

Exploitability : 1.7 / Impact : 2.7

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required HIGH

User Interaction REQUIRED

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact NONE

Scope CHANGED

References
Link Resource
https://github.com/Creatiwity/wityCMS/issues/150 Exploit Issue Tracking
https://github.com/Creatiwity/wityCMS/commit/7967e5bf15b4d2ee6b85b56e82d7e1229147de44 Patch
https://www.exploit-db.com/exploits/44790/ Exploit Patch
Configurations

Configuration 1

cpe:2.3:a:creatiwity:witycms:0.6.1:*:*:*:*:*:*:*
Information

Published : 2018-05-28 01:29

Updated : 2018-06-29 01:31

NVD link : CVE-2018-11512

Mitre link : CVE-2018-11512

Products Affected
No products.
CWE
CWE-79