XE before 1.11.6 is vulnerable to Unrestricted file upload via modules/menu/menu.admin.controller.php. When uploading the Mouse over button and When selected button, there is no restriction on the file suffix, which leads to any file uploading to the files directory. Since .htaccess only restricts the PHP type, uploading HTML-type files leads to stored XSS vulnerabilities.
References
Link | Resource |
---|---|
https://github.com/xpressengine/xe-core/issues/2434 | Exploit Patch Third Party Advisory |
https://github.com/xpressengine/xe-core/issues/2434 | Exploit Patch Third Party Advisory |
Configurations
History
21 Nov 2024, 06:31
Type | Values Removed | Values Added |
---|---|---|
References | () https://github.com/xpressengine/xe-core/issues/2434 - Exploit, Patch, Third Party Advisory |
16 Feb 2022, 22:15
Type | Values Removed | Values Added |
---|---|---|
CWE | CWE-79 | |
CVSS |
v2 : v3 : |
v2 : 3.5
v3 : 5.4 |
CPE | cpe:2.3:a:xpressengine:xpressengine:*:*:*:*:*:*:*:* | |
References | (MISC) https://github.com/xpressengine/xe-core/issues/2434 - Exploit, Patch, Third Party Advisory |
09 Feb 2022, 16:26
Type | Values Removed | Values Added |
---|---|---|
New CVE |
Information
Published : 2022-02-09 16:15
Updated : 2024-11-21 06:31
NVD link : CVE-2021-44911
Mitre link : CVE-2021-44911
CVE.ORG link : CVE-2021-44911
JSON object : View
Products Affected
xpressengine
- xpressengine
CWE
CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')