Vulnerability Description
Sulu is an open-source PHP content management system based on the Symfony framework. In versions of Sulu prior to 1.6.41, it is possible for a logged in admin user to add a script injection (cross-site-scripting) in the collection title. The problem is patched in version 1.6.41. As a workaround, one may manually patch the affected JavaScript files in lieu of updating.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Sulu | Sulu | < 1.6.41 |
Related Weaknesses (CWE)
References
- https://github.com/sulu/sulu/releases/tag/1.6.41Release NotesThird Party Advisory
- https://github.com/sulu/sulu/security/advisories/GHSA-gm2x-6475-g9r8Third Party Advisory
- https://github.com/sulu/sulu/releases/tag/1.6.41Release NotesThird Party Advisory
- https://github.com/sulu/sulu/security/advisories/GHSA-gm2x-6475-g9r8Third Party Advisory
FAQ
What is CVE-2021-32737?
CVE-2021-32737 is a vulnerability with a CVSS score of 8.4 (HIGH). Sulu is an open-source PHP content management system based on the Symfony framework. In versions of Sulu prior to 1.6.41, it is possible for a logged in admin user to add a script injection (cross-sit...
How severe is CVE-2021-32737?
CVE-2021-32737 has been rated HIGH with a CVSS base score of 8.4/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2021-32737?
Check the references section above for vendor advisories and patch information. Affected products include: Sulu Sulu.