There is stored cross site scripting (XSS) in Galileo CMS v0.042. Remote authenticated users could inject arbitrary web script or HTML via $page_title in /lib/Galileo/files/templates/page/show.html.ep (aka the PAGE TITLE Field).
References
| Link | Resource |
|---|---|
| https://github.com/jberger/Galileo/pull/55/files | Third Party Advisory |
| https://metacpan.org/changes/distribution/Galileo | Third Party Advisory |
| https://metamorfosec.com/Files/Advisories/METS-2020-002-A_Stored_XSS_Vulnerability_in_Galileo_CMS_v0.042.txt | Third Party Advisory |
| https://metamorfosec.com/Files/Commits/METC-2020-002-Escape_banner_in_Galileo_CMS_v0.042.txt | Patch Third Party Advisory |
| https://github.com/jberger/Galileo/pull/55/files | Third Party Advisory |
| https://metacpan.org/changes/distribution/Galileo | Third Party Advisory |
| https://metamorfosec.com/Files/Advisories/METS-2020-002-A_Stored_XSS_Vulnerability_in_Galileo_CMS_v0.042.txt | Third Party Advisory |
| https://metamorfosec.com/Files/Commits/METC-2020-002-Escape_banner_in_Galileo_CMS_v0.042.txt | Patch Third Party Advisory |
Configurations
History
21 Nov 2024, 04:48
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://github.com/jberger/Galileo/pull/55/files - Third Party Advisory | |
| References | () https://metacpan.org/changes/distribution/Galileo - Third Party Advisory | |
| References | () https://metamorfosec.com/Files/Advisories/METS-2020-002-A_Stored_XSS_Vulnerability_in_Galileo_CMS_v0.042.txt - Third Party Advisory | |
| References | () https://metamorfosec.com/Files/Commits/METC-2020-002-Escape_banner_in_Galileo_CMS_v0.042.txt - Patch, Third Party Advisory |
Information
Published : 2020-08-14 14:15
Updated : 2024-11-21 04:48
NVD link : CVE-2019-7410
Mitre link : CVE-2019-7410
CVE.ORG link : CVE-2019-7410
JSON object : View
Products Affected
galileo_cms_project
- galileo_cms
CWE
CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')