En bref
- CVE-2021-32737 est une vulnérabilité MOYENNE (CVSS 4.8) touchant sulu/sulu, sulu (sulu).
- Probabilité d'exploitation dans les 30 prochains jours (EPSS) : 0.66%, plus élevée que 51.9% des vulnérabilités.
- Correctif : mettre à jour vers 1.6.41 ou plus récent.
| Package | Affected versions | Patched versions |
|---|
| sulu/sulu Packagist | < 1.6.41
| 1.6.41
|
| sulu | < 1.6.41
| 1.6.41
|
Description
Impact
A logged in admin user was possible to add a script injection (XSS) in the collection title which was executed.
Workarounds
Manual patching the js files.
For more information
If you have any questions or comments about this advisory:'
NVD description
Sulu is an open-source PHP content management system based on the Symfony framework. In versions of Sulu prior to 1.6.41, it is possible for a logged in admin user to add a script injection (cross-site-scripting) in the collection title. The problem is patched in version 1.6.41. As a workaround, one may manually patch the affected JavaScript files in lieu of updating.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free