MEDIUM4.8

GHSA-5hf2-7xf4-w3j6

GeniXCMS Cross-site Scripting

Quick fix

GHSA-5hf2-7xf4-w3j6 — genix/cms: upgrade to the fixed version with the command below.

composer require genix/cms:^1.1.0

Details

GeniXCMS 1.0.2 has XSS triggered by a comment that is mishandled during a publish operation by an administrator, as demonstrated by a malformed P element.

Are you affected?

Enter the version of the package you're using.

Affected packages

Packagist/genix/cms

Introduced in: 0Fixed in: 1.1.0

Fixcomposer require genix/cms:^1.1.0

References

https://nvd.nist.gov/vuln/detail/CVE-2017-8780[ADVISORY]
https://github.com/semplon/GeniXCMS/issues/74[WEB]
https://github.com/semplon/GeniXCMS/commit/e0ad60b2bb967fa3f63c35b92afe84c5f3b31009[WEB]
https://github.com/GeniXCMS/GeniXCMS[PACKAGE]