CVE-2024-8572

Katalog CVE

CVSS 6.1 · Medium EPSS 0,43%

Kerentanan Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') pada gouniverse golang cms. Skor CVSS 3.1 6.1 (Medium) menurut NVD.

Deskripsi (NVD)

A vulnerability was found in Gouniverse GoLang CMS 1.4.0. It has been declared as problematic. This vulnerability affects the function PageRenderHtmlByAlias of the file FrontendHandler.go. The manipulation of the argument alias leads to cross site scripting. The attack can be initiated remotely. Upgrading to version 1.4.1 is able to address this issue. The patch is identified as 3e661cdfb4beeb9fe2ad507cdb8104c0b17d072c. It is recommended to upgrade the affected component.

Rincian

Terbit di NVD

8 September 2024

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

6.1 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

EPSS (30 hari)

0,43% peluang dieksploitasi; lebih tinggi dari 35,3% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/gouniverse/cms/commit/3e661cdfb4beeb9fe2ad507cdb8104c0b17d072c patch
• https://vuldb.com/?id.276802 advisory pihak ketiga · vdb entry
• https://vuldb.com/?submit.401896 advisory pihak ketiga · vdb entry
• https://github.com/gouniverse/cms/issues/5 issue tracking
• https://github.com/gouniverse/cms/issues/5#issuecomment-2330848731 issue tracking
• https://github.com/gouniverse/cms/releases/tag/v1.4.1 release notes
• https://vuldb.com/?ctiid.276802 permissions required