CVE-2024-8572

low-risk

Published 2024-09-08

A vulnerability was found in Gouniverse GoLang CMS 1.4.0. It has been declared as problematic. This vulnerability affects the function PageRenderHtmlByAlias of the file FrontendHandler.go. The manipulation of the argument alias leads to cross site scripting. The attack can be initiated remotely. Upgrading to version 1.4.1 is able to address this issue. The patch is identified as 3e661cdfb4beeb9fe2ad507cdb8104c0b17d072c. It is recommended to upgrade the affected component.

Do I need to act?

0.26% chance of exploitation

EPSS score — low exploit probability

Not on CISA KEV list

No confirmed active exploitation reported to CISA

Patch status unknown

Check vendor advisories for fix availability and mitigation guidance

CVSS 3.5/10 Low

NETWORK / LOW complexity

Affected Products (1)

Golang Cms

Affected Vendors

Gouniverse

References (7)

Patch https://github.com/gouniverse/cms/commit/3e661cdfb4beeb9fe2ad507cdb8104c0b17d072...

Issue Tracking https://github.com/gouniverse/cms/issues/5

Issue Tracking https://github.com/gouniverse/cms/issues/5#issuecomment-2330848731

Release Notes https://github.com/gouniverse/cms/releases/tag/v1.4.1

Permissions Required https://vuldb.com/?ctiid.276802

Third Party Advisory https://vuldb.com/?id.276802

Third Party Advisory https://vuldb.com/?submit.401896

/ 100

low-risk

Severity 16/34 · Moderate

Exploitability 1/34 · Minimal

Exposure 5/34 · Minimal