Vulnerability Description
Authenticated users with Site roles may inject XSS scripts via file names that will execute in the browser for this and other users of the same site.
CVSS Score
6.5
MEDIUM
CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:N/A:L
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Craftercms | Crafter Cms | >= 3.1.0, < 3.1.12 |
Related Weaknesses (CWE)
References
- https://docs.craftercms.org/en/3.1/security/advisory.html#cv-2021120103Vendor Advisory
- https://docs.craftercms.org/en/3.1/security/advisory.html#cv-2021120103Vendor Advisory
FAQ
What is CVE-2021-23260?
CVE-2021-23260 is a vulnerability with a CVSS score of 6.5 (MEDIUM). Authenticated users with Site roles may inject XSS scripts via file names that will execute in the browser for this and other users of the same site.
How severe is CVE-2021-23260?
CVE-2021-23260 has been rated MEDIUM with a CVSS base score of 6.5/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2021-23260?
Check the references section above for vendor advisories and patch information. Affected products include: Craftercms Crafter Cms.