-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| redaxo/source | composer | < 5.20.1 | 5.20.1 |
PHPPHPMiggo AIRoot Cause AnalysisThe vulnerability is a stored cross-site scripting (XSS) issue in the REDAXO CMS. The provided commit 58929062312cf03e344ab04067a365e6b6ee66aa addresses this by adding output escaping in the mediapool addon. The analysis of this commit reveals three vulnerable locations.
rex_media_service::addMedia: This function is called when a new media file is uploaded. The patch shows that the file extension from the user-provided file name was not escaped when constructing an error message for disallowed file types. This could be exploited by uploading a file with a malicious name, causing a stored XSS.
rex_media_service::updateMedia: Similar to addMedia, this function did not escape the new file extension when generating an error message during a file update. This also presents a stored XSS vulnerability.
media.list.php: This page is vulnerable to reflected XSS. The types parameter from the URL was displayed without escaping, allowing for the injection of malicious scripts.
The CVE description mentions the vulnerability is in the "module management component". While the patch is in the mediapool addon, it is likely that the media pool is used within the module management interface. An attacker could trigger the vulnerability by uploading a malicious file through the media pool while creating or editing a module, which would then cause the unescaped error message to be rendered, executing the malicious script. This connects the patched code in the mediapool to the vulnerability description related to module management.
rex_media_service::addMediaredaxo/src/addons/mediapool/lib/service_media.php
rex_media_service::updateMediaredaxo/src/addons/mediapool/lib/service_media.php
media.list.phpredaxo/src/addons/mediapool/pages/media.list.php
Ongoing coverage of React2Shell