Moole Vulnerability Database

Find real vulnerabilities before they ship

Medium

CVE-2020-23234

Cross Site Scripting (XSS) vulnerabiity exists in LavaLite CMS 5.8.0 via the Menu Blocks feature, which can be bypassed by using HTML event handlers, such as "ontoggle,".

VectorNETWORK

PublishedJul 26, 2021, 20:15

Published Bycve@mitre.org

Base Score

Score4.8

Affected Versions

Package (Ecosystem)IntroducedFixedLimit

lavalite/cms(Packagist)0N/AN/A

References

https://github.com/LavaLite/cms/issues/320

Weakness Type

CWE-79

CVSS Metrics

Base Score

4.8

Vector String

CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

Base SeverityMedium

Version

3.1

Attack Vector (AV)

NETWORK