요약
- CVE-2021-32737은(는) sulu/sulu, sulu (sulu)에 영향을 주는 보통 (CVSS 4.8) 취약점입니다.
- 향후 30일 내 악용 확률(EPSS): 0.66%, 전체 취약점의 51.8%보다 높음.
- 조치: 1.6.41 이상으로 업데이트하세요.
| Package | Affected versions | Patched versions |
|---|
| sulu/sulu Packagist | < 1.6.41
| 1.6.41
|
| sulu | < 1.6.41
| 1.6.41
|
Description
Impact
A logged in admin user was possible to add a script injection (XSS) in the collection title which was executed.
Workarounds
Manual patching the js files.
For more information
If you have any questions or comments about this advisory:'
NVD description
Sulu is an open-source PHP content management system based on the Symfony framework. In versions of Sulu prior to 1.6.41, it is possible for a logged in admin user to add a script injection (cross-site-scripting) in the collection title. The problem is patched in version 1.6.41. As a workaround, one may manually patch the affected JavaScript files in lieu of updating.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free