MEDIUM4.7

GHSA-mmx8-vrfg-hfmq

Piranha CMS Cross-site Scripting vulnerability

Details

A stored cross-site scripting (XSS) vulnerability in Piranha CMS 11.1 allows remote attackers to execute arbitrary JavaScript in the web browser of a user, by creating a page via the /manager/pages and then adding a markdown content with the XSS payload.

Are you affected?

Enter the version of the package you're using.

Affected packages

NuGet/Piranha

Introduced in: 0

No fixed version published yet for Piranha (nuget). Pin to a known-safe version or switch to an alternative.

References

https://nvd.nist.gov/vuln/detail/CVE-2024-55341[ADVISORY]
https://github.com/PiranhaCMS/piranha.core[PACKAGE]
https://sec-fortress.github.io/posts/articles/posts/CVE-2024-55341.html[WEB]