CVE-2020-24860

CMS Made Simple 2.2.14 allows an authenticated user with access to the Content Manager to edit content and put persistent XSS payload in the affected text fields. The user can get cookies from every authenticated user who visits the website.

CVSS v3.1

5.4 MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

CVSS v2.0

3.5 LOWAV:N/AC:M/Au:S/C:N/I:P/A:N

EPSS

1.09% chance of exploitation in the next 30 days, 63th percentile

Published

2020-10-01

Updated

2024-08-04

Proof-of-concept exploits (3)

• http://packetstormsecurity.com/files/159434/CMS-Made-Simple-2.2.14-Cross-Site-Scripting.h…
• https://www.exploit-db.com/exploits/48851
• https://www.youtube.com/watch?v=M6D7DmmjLak&t=22s

References

• CVE Record
• NVD entry

Related

• CVE-2020-24847
• CVE-2020-24861
• CVE-2020-24841
• CVE-2020-24862
• CVE-2020-24821
• CVE-2020-24881