- Description
- Statamic is a Laravel and Git powered content management system (CMS). Prior to versions 5.73.16 and 6.7.2, the `user:reset_password_form` tag could render user-input directly into HTML without escaping, allowing an attacker to craft a URL that executes arbitrary JavaScript in the victim's browser. This has been fixed in 5.73.16 and 6.7.2.
- Source
- security-advisories@github.com
- NVD status
- Analyzed
- Products
- statamic
CVSS 3.1
- Type
- Secondary
- Base score
- 6.1
- Impact score
- 2.7
- Exploitability score
- 2.8
- Vector string
- CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
- Severity
- MEDIUM
- security-advisories@github.com
- CWE-79
- Hype score
- Not currently trending
[
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:statamic:statamic:*:*:*:*:*:*:*:*",
"matchCriteriaId": "EACDC143-742E-4926-9C28-6095690EB549",
"versionEndExcluding": "5.73.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:statamic:statamic:*:*:*:*:*:*:*:*",
"matchCriteriaId": "631FF065-0872-4DC7-AB25-AB74B782A9BE",
"versionEndExcluding": "6.7.2",
"versionStartIncluding": "6.0.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
]