What is GHSA-m2r2-qc49-gqw4?

GHSA-m2r2-qc49-gqw4 is a security advisory published by GitHub Security Advisories with Medium severity. Gleez CMS Stored XSS

Which CVE IDs does GHSA-m2r2-qc49-gqw4 cover?

GHSA-m2r2-qc49-gqw4 covers the following CVE IDs: CVE-2018-7035. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-m2r2-qc49-gqw4?

GHSA-m2r2-qc49-gqw4 has a CVSS v3 base score of 5.4, published by GitHub Security Advisories.

Which products are affected by GHSA-m2r2-qc49-gqw4?

GHSA-m2r2-qc49-gqw4 affects 2 products, including: composer/gleez/cms:\u003c= 1.2.0; composer/gleez/cms:= 2.0.0.

GHSA-m2r2-qc49-gqw4MediumCVSS 5.4

Gleez CMS Stored XSS

Vendor

GitHub Security Advisories

Published

May 14, 2022

Last Modified

October 6, 2023

🔗 CVE IDs covered (1)

CVE-2018-7035 →

📋 Description

Cross-site scripting (XSS) vulnerability in Gleez CMS 1.2.0 and 2.0 might allow remote attackers (users) to inject JavaScript via HTML content in an editor, which will result in Stored XSS when an Administrator tries to edit the same content, as demonstrated by use of the source editor for HTML mode in an Add Blog action.

🎯 Affected products2

composer/gleez/cms:<= 1.2.0
composer/gleez/cms:= 2.0.0

🔗 References (5)

https://nvd.nist.gov/vuln/detail/CVE-2018-7035
https://github.com/gleez/cms/issues/794
https://github.com/gleez/cms/commit/d4ad1844e9fe6e2b9b92dfb351fb7e01047f9565
https://github.com/gleez/cms/issues/796
https://github.com/advisories/GHSA-m2r2-qc49-gqw4