VulnerabilityModified
CVE-2019-7410
There is stored cross site scripting (XSS) in Galileo CMS v0.042.
MEDIUM 6.1EPSS 1.16%
Does this matter?
Lower severity and a low EPSS score (1.16%). Track it; it rarely justifies an emergency change on its own.
Description
There is stored cross site scripting (XSS) in Galileo CMS v0.042. Remote authenticated users could inject arbitrary web script or HTML via $page_title in /lib/Galileo/files/templates/page/show.html.ep (aka the PAGE TITLE Field).
- CVSS 3.1
- 6.1 MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
- EPSS
- 1.16% probability · 65th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-79
- Affected
- galileo cms project/galileo cms
- Source
- cve@mitre.org
References
- https://github.com/jberger/Galileo/pull/55/filesThird Party Advisory
- https://metacpan.org/changes/distribution/GalileoThird Party Advisory
- https://metamorfosec.com/Files/Advisories/METS-2020-002-A_Stored_XSS_Vulnerability_in_Galileo_CMS_v0.042.txtThird Party Advisory
- https://metamorfosec.com/Files/Commits/METC-2020-002-Escape_banner_in_Galileo_CMS_v0.042.txtPatch, Third Party Advisory
- https://github.com/jberger/Galileo/pull/55/filesThird Party Advisory
- https://metacpan.org/changes/distribution/GalileoThird Party Advisory
- https://metamorfosec.com/Files/Advisories/METS-2020-002-A_Stored_XSS_Vulnerability_in_Galileo_CMS_v0.042.txtThird Party Advisory
- https://metamorfosec.com/Files/Commits/METC-2020-002-Escape_banner_in_Galileo_CMS_v0.042.txtPatch, Third Party Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.