CVE-2018-18260 Camaleon CMS vulnerable to Stored Cross-site Scripting

What is CVE-2018-18260?

CVE-2018-18260 is a medium-severity cross-site scripting vulnerability in n/a, published on 15 Oct 2018. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.

Official description

In the 2.4 version of Camaleon CMS, Stored XSS has been discovered. The profile image in the User settings section can be run in the update / upload area via /admin/media/upload?actions=false. NOTE: the vendor reports that they are "unable to reproduce the reported issue on any version."

Weakness: CWE-79

Which versions are affected by CVE-2018-18260?

2 open source packages ship an affected version, including camaleon_cms. It affects 1 product.

Products include Tuzitio Camaleon Cms.

How do I fix CVE-2018-18260?

No fix has been published for CVE-2018-18260 yet. Limit exposure of the affected software until one is available.

Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.

Is CVE-2018-18260 being exploited?

There is no known exploitation of CVE-2018-18260 in the wild and no public exploit code.

Other vulnerabilities in n/a

• CVE-2024-46986 Arbitrary file write leading to RCE in Camaleon CMS Critical 10.0
• CVE-2023-30145 Server-Side Template Injection in Camaleon CMS Critical 9.8
• CVE-2021-25970 Camaleon CMS - Insufficient Session Expiration after Password Change High 8.8
• CVE-2024-46987 Arbitrary path traversal in Camaleon CMS High 7.7
• CVE-2021-25969 Camaleon CMS - Stored Cross-Site Scripting (XSS) in Comments Medium 6.1

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-7f84-9cqf-g4j9.