medium6.1
CVE-2019-7410
There is stored cross site scripting (XSS) in Galileo CMS v0.042.
Impact
There is stored cross site scripting (XSS) in Galileo CMS v0.042. Remote authenticated users could inject arbitrary web script or HTML via $page_title in /lib/Galileo/files/templates/page/show.html.ep (aka the PAGE TITLE Field).
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Galileo Cms Project | Galileo Cms | Version 0.042 |
Weakness classification
References
- NVD record
- CVE.org record
- https://github.com/jberger/Galileo/pull/55/files
- https://metacpan.org/changes/distribution/Galileo
- https://metamorfosec.com/Files/Advisories/METS-2020-002-A_Stored_XSS_Vulnerability_in_Galileo_CMS_v0.042.txt
- https://metamorfosec.com/Files/Commits/METC-2020-002-Escape_banner_in_Galileo_CMS_v0.042.txt
- https://github.com/jberger/Galileo/pull/55/files
- https://metacpan.org/changes/distribution/Galileo
- https://metamorfosec.com/Files/Advisories/METS-2020-002-A_Stored_XSS_Vulnerability_in_Galileo_CMS_v0.042.txt
- https://metamorfosec.com/Files/Commits/METC-2020-002-Escape_banner_in_Galileo_CMS_v0.042.txt