CVE-2020-4041

Katalog CVE

CVSS 6.1 · Medium EPSS 2,0%

Kerentanan Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') pada boltcms bolt. Skor CVSS 3.1 6.1 (Medium) menurut NVD.

Deskripsi (NVD)

In Bolt CMS before version 3.7.1, the filename of uploaded files was vulnerable to stored XSS. It is not possible to inject javascript code in the file name when creating/uploading the file. But, once created/uploaded, it can be renamed to inject the payload in it. Additionally, the measures to prevent renaming the file to disallowed filename extensions could be circumvented. This is fixed in Bolt 3.7.1.

Rincian

Terbit di NVD

8 Juni 2020

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

6.1 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

EPSS (30 hari)

2,0% peluang dieksploitasi; lebih tinggi dari 80,5% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/bolt/bolt/commit/b42cbfcf3e3108c46a80581216ba03ef449e419f patch · advisory pihak ketiga
• https://github.com/bolt/bolt/pull/7853 patch · advisory pihak ketiga
• https://github.com/bolt/bolt/security/advisories/GHSA-68q3-7wjp-7q3j patch · advisory pihak ketiga
• http://packetstormsecurity.com/files/158299/Bolt-CMS-3.7.0-XSS-CSRF-Shell-Upload.html exploit · advisory pihak ketiga · vdb entry
• http://seclists.org/fulldisclosure/2020/Jul/4 exploit · mailing list · advisory pihak ketiga