CVE-2021-41169

Published: Oct 21, 2021Modified: Nov 21, 2024

4.8

Vector

CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

Exploitability: 1.7 / Impact: 2.7

Source: NVD

Description

Sulu is an open-source PHP content management system based on the Symfony framework. In versions before 1.6.43 are subject to stored cross site scripting attacks. HTML input into Tag names is not properly sanitized. Only admin users are allowed to create tags. Users are advised to upgrade.

Affected (1)

Products: Sulu: Sulu

1 product

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Sulu Sulu	Before 1.6.43

Related CWEs

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

References (4)

https://github.com/sulu/sulu/commit/20007ac70a3af3c9e53a6acb0ef8794b65642445

Source: security-advisories@github.com

PatchThird Party Advisory

https://github.com/sulu/sulu/security/advisories/GHSA-h58v-g3q6-q9fx

Source: security-advisories@github.com

Third Party Advisory

https://github.com/sulu/sulu/commit/20007ac70a3af3c9e53a6acb0ef8794b65642445

Source: af854a3a-2127-422b-91ae-364da2661108

PatchThird Party Advisory

https://github.com/sulu/sulu/security/advisories/GHSA-h58v-g3q6-q9fx

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

Timeline

No history available yet.