Em resumo
- CVE-2022-40849 é uma vulnerabilidade MÉDIO (CVSS 5.4) que afeta thinkcmf/thinkcmf, thinkcmf (thinkcmf).
- Chance de exploração nos próximos 30 dias (EPSS): 0.41%, maior que 35.6% das vulnerabilidades.
- Correção: atualize para 6.0.8 ou posterior.
Description
ThinkCMF version 6.0.7 is affected by Stored Cross-Site Scripting (XSS). An attacker who successfully exploited this vulnerability could inject a Persistent XSS payload in the Slideshow Management section that execute arbitrary JavaScript code on the client side, e.g., to steal the administrator's PHP session token (PHPSESSID).
NVD description
ThinkCMF version 6.0.7 is affected by Stored Cross-Site Scripting (XSS). An attacker who successfully exploited this vulnerability could inject a Persistent XSS payload in the Slideshow Management section that execute arbitrary JavaScript code on the client side, e.g., to steal the administrator's PHP session token (PHPSESSID).
Mais vulnerabilidades de thinkcmf/thinkcmf
Ver tudo →Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free