An HTML injection vulnerability exists in the Edit Content Layout module of Kirby CMS v4.1.0. NOTE: the vendor disputes the significance of this report because some HTML formatting (such as with an H1 element) is allowed, but there is backend sanitization such that the reporter's mentioned "injecting malicious scripts" would not occur.
CVSS Details
- CVSS 3.1 Base Score: 7.1
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Suse | — | Upgrade dtb-apmUpgrade dtb-amdUpgrade kernel-zfcpdumpUpgrade kernel-kvmsmallUpgrade kernel-sourceUpgrade gfs2-kmp-64kbUpgrade dtb-armUpgrade cluster-md-kmp-defaultUpgrade kernel-default-extraUpgrade dtb-mediatekUpgrade kernel-kvmsmall-develUpgrade kernel-develUpgrade reiserfs-kmp-defaultUpgrade kernel-obs-qaUpgrade kernel-64kb-livepatch-develUpgrade kernel-symsUpgrade kernel-debug-livepatch-develUpgrade kernel-debugUpgrade kernel-64kbUpgrade dlm-kmp-64kbUpgrade dtb-freescaleUpgrade kernel-debug-develUpgrade dtb-lgUpgrade kernel-macrosUpgrade kernel-64kb-develUpgrade dtb-xilinxUpgrade kselftests-kmp-defaultUpgrade dtb-amazonUpgrade dtb-amlogicUpgrade kernel-kvmsmall-livepatch-develUpgrade kernel-default-develUpgrade dtb-appleUpgrade dtb-exynosUpgrade kernel-default-optionalUpgrade dtb-hisiliconUpgrade kselftests-kmp-64kbUpgrade kernel-64kb-optionalUpgrade dtb-allwinnerUpgrade kernel-default-vdsoUpgrade dtb-alteraUpgrade kernel-obs-buildUpgrade kernel-docsUpgrade kernel-default-livepatchUpgrade kernel-source-vanillaUpgrade gfs2-kmp-defaultUpgrade dtb-renesasUpgrade dtb-caviumUpgrade kernel-default-livepatch-develUpgrade dtb-qcomUpgrade kernel-64kb-extraUpgrade kernel-debug-vdsoUpgrade kernel-defaultUpgrade kernel-default-baseUpgrade kernel-docs-htmlUpgrade ocfs2-kmp-64kbUpgrade cluster-md-kmp-64kbUpgrade kernel-kvmsmall-vdsoUpgrade kernel-default-base-rebuildUpgrade dtb-socionextUpgrade ocfs2-kmp-defaultUpgrade dtb-sprdUpgrade dtb-rockchipUpgrade dtb-broadcomUpgrade dlm-kmp-defaultUpgrade reiserfs-kmp-64kbUpgrade dtb-marvellUpgrade dtb-nvidia | Jul 23, 2024 | Feb 22, 2024 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub