Lighthouse has a new layout. Prefer the old one? Return to the old layout, and switch back any time from the link at the top of each page.

Exponent CMS 2.3.5 Cross-Site Scripting Vulnerability

#1320

Exponent CMS 2.3.5 Cross-Site Scripting Vulnerability

Information

Vulnerability Type : Exponent CMS 2.3.5 Cross-Site Scripting Vulnerability
Vulnerable Version : 2.3.5
CVE-ID :
Severity: High
Author – Sachin Wagh (@tiger_tigerboy)

Description

Exponent CMS is prone to a Cross-site scripting vulnerability because it fails to sanitize user-supplied input ‘Username/Email’ field of ‘Reset Your Password’ module . An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site.

Credits & Authors

Sachin Wagh (@tiger_tigerboy)

Reported by Sachin Wagh · December 24th, 2015 @ 08:39 AM

State: resolved
Milestone: 2.3.6
Assigned to: dleffler dleffler

Activity

  1. expNinja
    expNinja
    • State changed from new to resolved

    (from [3ea25aadd83935b04b4c5e31518a7b05a8220cad]) Update input santization for security issues using code gleaned from CodeIgniter project [#1320 state:resolved] https://github.com/exponentcms/exponent-cms/commit/3ea25aadd83935b0...

    December 24th, 2015 @ 03:32 PM

  2. Sachin Wagh
    Sachin Wagh

    Hi expNinja,

    Is there any CVE-ID for it.

    December 24th, 2015 @ 03:40 PM

  3. Sachin Wagh
    Sachin Wagh

    Thanks dleffler.

    Once assigned CVE-ID please let me know.

    Thanks a lot.

    December 24th, 2015 @ 04:07 PM

  4. Sachin Wagh
    Sachin Wagh

    Thanks dleffer. :)

    December 25th, 2015 @ 07:00 AM

Please Sign in or create a free account to add a new ticket.

With your very own profile, you can contribute to projects, track your activity, watch tickets, receive and update tickets through your email and much more.