MEDIUM4.8

GHSA-x8wj-cqmp-3wmm

Cross-site Scripting in Zenario CMS

Quick fix

GHSA-x8wj-cqmp-3wmm — tribalsystems/zenario: upgrade to the fixed version with the command below.

composer require tribalsystems/zenario:^9.0.55143

Details

Zenario CMS 9.0.54156 is vulnerable to Cross Site Scripting (XSS) via upload file to *.SVG. An attacker can send malicious files to victims and steals victim's cookie leads to account takeover. The person viewing the image of a contact can be victim of XSS.

Are you affected?

Enter the version of the package you're using.

Affected packages

Packagist/tribalsystems/zenario

Introduced in: 0Fixed in: 9.0.55143

Fixcomposer require tribalsystems/zenario:^9.0.55143

References

https://nvd.nist.gov/vuln/detail/CVE-2021-41952[ADVISORY]
https://github.com/hieuminhnv/Zenario-CMS-9.0-last-version/issues/1[WEB]
https://github.com/TribalSystems/Zenario/commit/4566d8a9ac6755f098b3373252fdb17754a77007[WEB]
https://github.com/TribalSystems/Zenario[PACKAGE]
https://github.com/TribalSystems/Zenario/releases/tag/9.0.55141[WEB]