VulnerabilityModified
CVE-2021-41169
In versions before 1.6.43 are subject to stored cross site scripting attacks.
MEDIUM 4.8EPSS 0.59%
Does this matter?
Lower severity and a low EPSS score (0.59%). Track it; it rarely justifies an emergency change on its own.
Description
Sulu is an open-source PHP content management system based on the Symfony framework. In versions before 1.6.43 are subject to stored cross site scripting attacks. HTML input into Tag names is not properly sanitized. Only admin users are allowed to create tags. Users are advised to upgrade.
- CVSS 3.1
- 4.8 MEDIUMCVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
- EPSS
- 0.59% probability · 46th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-79
- Affected
- sulu/sulu
- Source
- security-advisories@github.com
References
- https://github.com/sulu/sulu/commit/20007ac70a3af3c9e53a6acb0ef8794b65642445Patch, Third Party Advisory
- https://github.com/sulu/sulu/security/advisories/GHSA-h58v-g3q6-q9fxThird Party Advisory
- https://github.com/sulu/sulu/commit/20007ac70a3af3c9e53a6acb0ef8794b65642445Patch, Third Party Advisory
- https://github.com/sulu/sulu/security/advisories/GHSA-h58v-g3q6-q9fxThird Party Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.