CVE-2021-44912

In XE 1.116, when uploading the Normal button, there is no restriction on the file suffix, which leads to any file uploading to the files directory. Since .htaccess only restricts the PHP type, uploading HTML-type files leads to stored XSS vulnerabilities. If the .htaccess configuration is improper, for example before the XE 1.11.2 version, you can upload the PHP type file to GETSHELL.
References
Link Resource
https://github.com/xpressengine/xe-core/issues/2433 Exploit Issue Tracking Third Party Advisory
Configurations

Configuration 1 (hide)

cpe:2.3:a:xpressengine:xpressengine:*:*:*:*:*:*:*:*

History

16 Feb 2022, 22:25

Type Values Removed Values Added
CWE CWE-79
CPE cpe:2.3:a:xpressengine:xpressengine:*:*:*:*:*:*:*:*
References (MISC) https://github.com/xpressengine/xe-core/issues/2433 - (MISC) https://github.com/xpressengine/xe-core/issues/2433 - Exploit, Issue Tracking, Third Party Advisory
CVSS v2 : unknown
v3 : unknown
v2 : 3.5
v3 : 5.4

09 Feb 2022, 16:26

Type Values Removed Values Added
New CVE

Information

Published : 2022-02-09 16:15

Updated : 2024-02-04 22:08


NVD link : CVE-2021-44912

Mitre link : CVE-2021-44912

CVE.ORG link : CVE-2021-44912


JSON object : View

Products Affected

xpressengine

  • xpressengine
CWE
CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')