MEDIUM6.1

GHSA-v762-47vh-j7q3

Feehi CMS vulnerable to Cross-site Scripting in Username Field

Quick fix

GHSA-v762-47vh-j7q3 — feehi/cms: upgrade to the fixed version with the command below.

composer require feehi/cms:^2.0.8.1

Details

Feehi CMS 2.0.8 is affected by a cross-site scripting (XSS) vulnerability. When the user name is inserted as JavaScript code, browsing the post will trigger the XSS.

Are you affected?

Enter the version of the package you're using.

Affected packages

Packagist/feehi/cms

Introduced in: 0Fixed in: 2.0.8.1

Fixcomposer require feehi/cms:^2.0.8.1

References

https://nvd.nist.gov/vuln/detail/CVE-2020-21146[ADVISORY]
https://github.com/liufee/cms/issues/43[WEB]
https://github.com/liufee/cms/commit/e92f6877d96e53498101d0664174956e94223d6e[WEB]
https://github.com/liufee/cms[PACKAGE]