Camaleon CMS vulnerable to Stored Cross-site Scripting

中危 6.1CVE-2018-18260 · GHSA-7f84-9cqf-g4j9 · Published 15/10/2018 · updated 17/06/2026

要点

CVE-2018-18260 是影响 camaleon_cms, camaleon cms (tuzitio) 的中危 (CVSS 6.1)漏洞。
未来 30 天内被利用的概率（EPSS）：1.0%，高于 64.3% 的漏洞。
暂无已修复版本：请关注参考资料中的厂商公告。

Package	Affected versions	Patched versions
camaleon_cms RubyGems	`= 2.4`	No fix yet
camaleon cms tuzitio	`= 2.4.0`	No fix yet

Description

In the 2.4 version of Camaleon CMS, Stored XSS has been discovered. The profile image in the User settings section can be run in the update / upload area via /admin/media/upload?actions=false.

NVD description

In the 2.4 version of Camaleon CMS, Stored XSS has been discovered. The profile image in the User settings section can be run in the update / upload area via /admin/media/upload?actions=false. NOTE: the vendor reports that they are "unable to reproduce the reported issue on any version."

References

nvd.nist.gov/vuln/detail/CVE-2018-18260 · ADVISORY
owen2345/camaleon-cms · PACKAGE
rubysec/ruby-advisory-db · WEB
packetstormsecurity.com/files/149772/CAMALEON-CMS-2.4-Cross-Site-Scripting.html · WEB

camaleon_cms 的其他漏洞

查看全部 →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

camaleon_cms

RubyGems

= 2.4

No fix yet

camaleon cms

tuzitio

= 2.4.0

No fix yet

Description

In the 2.4 version of Camaleon CMS, Stored XSS has been discovered. The profile image in the User settings section can be run in the update / upload area via /admin/media/upload?actions=false.

NVD description

camaleon_cms 的其他漏洞

查看全部 →