Vulnerability · Published Jan 15, 2021 · Assigned by mitre
CVE-2021-23836
Medium 4.8
In plain English
A medium-severity security flaw in the affected software. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.9% (higher than 61% of all known vulnerabilities).
Severity (CVSS NVD)4.8Medium
Exploit odds (30 days)0.9%top 39.1% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
An issue was discovered in flatCore before 2.0.0 build 139. A stored XSS vulnerability was identified in the prefs_smtp_psw HTTP request body parameter for the acp interface. An admin user can inject malicious client-side script into the affected parameter without any form of input sanitization. The injected payload will be executed in the browser of a user whenever one visits the affected module page.
Affected products (as reported)
References
- https://github.com/flatCore/flatCore-CMS x_refsource_MISC
- https://sec-consult.com/vulnerability-lab/ x_refsource_MISC
- http://packetstormsecurity.com/files/160936/flatCore-CMS-XSS-File-Disclosure-SQL-Injection.html x_refsource_MISC