CVE-2020-23234

Cross Site Scripting (XSS) vulnerabiity exists in LavaLite CMS 5.8.0 via the Menu Blocks feature, which can be bypassed by using HTML event handlers, such as "ontoggle,".

Published: Jul 26, 2021
Updated: May 9, 2024
CVE: CVE-2020-23234
GHSA: GHSA-v2f3-f8x4-m3w8
Severity: Low
Exploit:

CVSS v3:

Severity: Low
Score: 4.8
AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

CVSS v2:

Severity: Low
Score: 3.5
AV:N/AC:M/Au:S/C:N/I:P/A:N

CWEs:

CWE-79

OWASP TOP 10:

A7 - Cross-Site Scripting (XSS)

Affected Software
References

Software	From	Fixed in
lavalite / lavalite	5.8.0	5.8.0.x
lavalite / cms	-	5.8.0.x

https://github.com/LavaLite/cms/issues/320

Vulnerability Database

CVE-2020-23234