CVE-2019-15228 Cross-site scripting in n/a
Cross-site scripting in FUEL CMS admin console allows attackers to steal cookies and perform malicious actions against visitors.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2019-15228?
CVE-2019-15228 is a medium-severity cross-site scripting vulnerability in n/a, published on 19 Aug 2019. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.
Official description
FUEL CMS 1.4.4 has XSS in the Create Blocks section of the Admin console. This could lead to cookie stealing and other malicious actions. This vulnerability can be exploited with an authenticated account but can also impact unauthenticated visitors.
Weakness: CWE-79
Which versions are affected by CVE-2019-15228?
It affects 1 product.
Products include Thedaylightstudio Fuel Cms.
How do I fix CVE-2019-15228?
No fix has been published for CVE-2019-15228 yet. Limit exposure of the affected software until one is available.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2019-15228 being exploited?
There is no known exploitation of CVE-2019-15228 in the wild and no public exploit code.
Other vulnerabilities in n/a
Sources
Also known as GHSA-j368-v454-frrv.