CVE-2021-44911

XE before 1.11.6 is vulnerable to Unrestricted file upload via modules/menu/menu.admin.controller.php. When uploading the Mouse over button and When selected button, there is no restriction on the file suffix, which leads to any file uploading to the files directory. Since .htaccess only restricts the PHP type, uploading HTML-type files leads to stored XSS vulnerabilities.
References
Link Resource
https://github.com/xpressengine/xe-core/issues/2434 Exploit Patch Third Party Advisory
https://github.com/xpressengine/xe-core/issues/2434 Exploit Patch Third Party Advisory
Configurations

Configuration 1 (hide)

cpe:2.3:a:xpressengine:xpressengine:*:*:*:*:*:*:*:*

History

21 Nov 2024, 06:31

Type Values Removed Values Added
References () https://github.com/xpressengine/xe-core/issues/2434 - Exploit, Patch, Third Party Advisory () https://github.com/xpressengine/xe-core/issues/2434 - Exploit, Patch, Third Party Advisory

16 Feb 2022, 22:15

Type Values Removed Values Added
CWE CWE-79
CVSS v2 : unknown
v3 : unknown
v2 : 3.5
v3 : 5.4
CPE cpe:2.3:a:xpressengine:xpressengine:*:*:*:*:*:*:*:*
References (MISC) https://github.com/xpressengine/xe-core/issues/2434 - (MISC) https://github.com/xpressengine/xe-core/issues/2434 - Exploit, Patch, Third Party Advisory

09 Feb 2022, 16:26

Type Values Removed Values Added
New CVE

Information

Published : 2022-02-09 16:15

Updated : 2024-11-21 06:31


NVD link : CVE-2021-44911

Mitre link : CVE-2021-44911

CVE.ORG link : CVE-2021-44911


JSON object : View

Products Affected

xpressengine

  • xpressengine
CWE
CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')