Vulnerability Description
A Stored XSS vulnerability has been discovered in version 4.1.0 of AlchemyCMS via the /admin/pictures image field. NOTE: the vendor's position is that this is not a valid report: "The researcher used an authorized cookie to perform the request to a password-protected route. Without that session cookie, the request would have been rejected as unauthorized."
CVSS Score
MEDIUM
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Alchemy-Cms | Alchemy Cms | 4.1.0 |
Related Weaknesses (CWE)
References
- http://packetstormsecurity.com/files/149787/Alchemy-CMS-4.1-Stable-Cross-Site-ScExploitThird Party AdvisoryVDB Entry
- https://github.com/AlchemyCMS/alchemy_cms/blob/4.1-stable/app/controllers/alchem
- https://github.com/AlchemyCMS/alchemy_cms/blob/4.1-stable/app/controllers/alchem
- https://github.com/AlchemyCMS/alchemy_cms/blob/4.1-stable/app/controllers/alchem
- https://www.exploit-db.com/exploits/45601
- http://packetstormsecurity.com/files/149787/Alchemy-CMS-4.1-Stable-Cross-Site-ScExploitThird Party AdvisoryVDB Entry
- https://github.com/AlchemyCMS/alchemy_cms/blob/4.1-stable/app/controllers/alchem
- https://github.com/AlchemyCMS/alchemy_cms/blob/4.1-stable/app/controllers/alchem
- https://github.com/AlchemyCMS/alchemy_cms/blob/4.1-stable/app/controllers/alchem
FAQ
What is CVE-2018-18307?
CVE-2018-18307 is a vulnerability with a CVSS score of 6.1 (MEDIUM). A Stored XSS vulnerability has been discovered in version 4.1.0 of AlchemyCMS via the /admin/pictures image field. NOTE: the vendor's position is that this is not a valid report: "The researcher used ...
How severe is CVE-2018-18307?
CVE-2018-18307 has been rated MEDIUM with a CVSS base score of 6.1/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2018-18307?
Check the references section above for vendor advisories and patch information. Affected products include: Alchemy-Cms Alchemy Cms.