Gleez Cms Cross-site Scripting in Profile Page
Date: 2022-05
Affected: composer/gleez/cms
Attack vector: xss
Category: vulnerability-disclosure
Severity: Medium
CVE: CVE-2018-1999021
CWE: CWE-79
CVSS: 5.4 (CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N)

Gleezcms Gleez Cms version 1.3.0 contains a Cross Site Scripting (XSS) vulnerability in Profile page that can result in injection of arbitrary web script or HTML via the profile page editor. The victim must navigate to the attacker's profile page to exploit this vulnerability.


Mitigations:

Architectural layers (MAESTRO):