Vulnerability · Published Dec 2, 2021 · Assigned by crafter
CVE-2021-23260Stored XSS Vulnerability in File Name of the File Upload function
Medium 6.5
In plain English
A medium-severity cross-site scripting in Crafter CMS from Crafter Software. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 39% of all known vulnerabilities).
Severity (CVSS 3.1)6.5Medium
Exploit odds (30 days)0.4%top 61.2% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
Authenticated users with Site roles may inject XSS scripts via file names that will execute in the browser for this and other users of the same site.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Crafter Software | Crafter CMS | 3.1 – before 3.1.12 |
Weakness: CWE-79 · Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:N/A:L