In the 2.4 version of Camaleon CMS, Stored XSS has been discovered. The profile image in the User settings section can be run in the update / upload area via /admin/media/upload?actions=false.
GSA_kwCzR0hTQS03Zjg0LTljcWYtZzRqOc3r0A
Camaleon CMS vulnerable to Stored Cross-site Scripting
| Affected Packages | Affected Versions | Fixed Versions | |
|---|---|---|---|
|
rubygems:camaleon_cms
PURL:
pkg:gem/camaleon_cms
|
= 2.4 | No known fixed version | |
Affected Version RangesAll affected versions2.4.0, 2.4.1, 2.4.2, 2.4.3, 2.4.4, 2.4.5 |
|||