Cross site scripting in Elefant CMS

MEDIUM 5.4CVE-2017-20061 · GHSA-hgm9-pww2-93pc · Published 20/06/2022 · updated 17/06/2026

In short

CVE-2017-20061 is a MEDIUM (CVSS 5.4) vulnerability affecting elefant/cms, elefant cms (elefantcms).
Chance of exploitation in the next 30 days (EPSS): 0.47%, higher than 40.5% of all vulnerabilities.
Fix: update to 1.3.13 or later.

Package	Affected versions	Patched versions
elefant/cms Packagist	`< 1.3.13`	`1.3.13`
elefant cms elefantcms	`= 1.3.12`	No fix yet

Description

A vulnerability has been found in Elefant CMS 1.3.12-RC and classified as problematic. This vulnerability affects unknown code of the file /admin/extended. The manipulation of the argument name with the input %3Cimg%20src=no%20onerror=alert(1)%3E leads to basic cross site scripting (Reflected). The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 1.3.13 is able to address this issue. It is recommended to upgrade the affected component.

NVD description

References

nvd.nist.gov/vuln/detail/CVE-2017-20061 · ADVISORY
jbroadway/elefant · PACKAGE
vuldb.com · WEB
seclists.org/fulldisclosure/2017/Feb/36 · WEB

More vulnerabilities in elefant/cms

See all →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

elefant/cms

Packagist

< 1.3.13

1.3.13

elefant cms

elefantcms

= 1.3.12

No fix yet

Description

NVD description

More vulnerabilities in elefant/cms

See all →