MEDIUM6.1

GHSA-x78v-4fvj-rg9j

Camaleon CMS Stored Cross-site Scripting vulnerability

Quick fix

GHSA-x78v-4fvj-rg9j — camaleon_cms: upgrade to the fixed version with the command below.

bundle update camaleon_cms

Details

In “Camaleon CMS” application, versions 0.0.1 through 2.6.0 are vulnerable to stored XSS, that allows unprivileged application users to store malicious scripts in the comments section of the post. These scripts are executed in a victim’s browser when they open the page containing the malicious comment.

Are you affected?

Enter the version of the package you're using.

Affected packages

RubyGems/camaleon_cms

Introduced in: 0.0.1Fixed in: 2.6.0.1

Fixbundle update camaleon_cms

References

https://nvd.nist.gov/vuln/detail/CVE-2021-25969[ADVISORY]
https://github.com/owen2345/camaleon-cms/commit/05506e9087bb05282c0bae6ccfe0283d0332ab3c[WEB]
https://github.com/owen2345/camaleon-cms[PACKAGE]
https://www.whitesourcesoftware.com/vulnerability-database/CVE-2021-25969[WEB]