Description
REDAXO before 5.21.0 contains a reflected cross-site scripting vulnerability that allows authenticated attackers to inject scripts via the type parameter of the metainfo_default_fields_create API. Attackers can craft a link with a valid CSRF token and HTML payload that rex_view::message() renders unescaped, executing scripts in a victim's backend session.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| redaxo | core | < 5.21.0 | 5.21.0 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Packagist | redaxo/source | < 5.21.0 | 5.21.0 | GHSA-m662-8jrj-cw6v |
References
- GitHub Security Advisory (GHSA-m662-8jrj-cw6v) vendor-advisory
- VulnCheck Advisory: REDAXO before 5.21.0 Reflected XSS via Metainfo API type Parameter third-party-advisory