high8.8
CVE-2020-9322
The /users endpoint in Statamic Core before 2.11.8 allows XSS to add an administrator user.
Impact
The /users endpoint in Statamic Core before 2.11.8 allows XSS to add an administrator user. This can be exploited via CSRF. Stored XSS can occur via a JavaScript payload in a username during account registration. Reflected XSS can occur via the /users PATH_INFO.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Statamic | Statamic Core | before 2.11.8 |
Versions were read from the advisory text. No structured product data has been published for this record yet.