CVE-2019-15228

FUEL CMS 1.4.4 has XSS in the Create Blocks section of the Admin console. This could lead to cookie stealing and other malicious actions. This vulnerability can be exploited with an authenticated account but can also impact unauthenticated visitors.

CVSS v3.0

5.4 MEDIUMCVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

CVSS v2.0

3.5 LOWAV:N/AC:M/Au:S/C:N/I:P/A:N

EPSS

0.73% chance of exploitation in the next 30 days, 52th percentile

Published

2019-08-19

Updated

2024-08-05

Proof-of-concept exploits (1)

• daylightstudio/FUEL-CMS/issues/536

References

• CVE Record
• NVD entry

Related

• CVE-2018-16416
• CVE-2019-15229
• CVE-2020-23721
• CVE-2020-24791
• CVE-2020-26045
• CVE-2020-28705