CVE-2024-8572

LOW

Gouniverse GoLang CMS 1.4.0 - Cross-Site Scripting via PageRenderHtmlByAlias Alias Parameter

Title source: llm
STIX 2.1

Description

A vulnerability was found in Gouniverse GoLang CMS 1.4.0. It has been declared as problematic. This vulnerability affects the function PageRenderHtmlByAlias of the file FrontendHandler.go. The manipulation of the argument alias leads to cross site scripting. The attack can be initiated remotely. Upgrading to version 1.4.1 is able to address this issue. The patch is identified as 3e661cdfb4beeb9fe2ad507cdb8104c0b17d072c. It is recommended to upgrade the affected component.

References (7)

Core 7
Core References
Third Party Advisory, VDB Entry vdb-entry technical-description
https://vuldb.com/?id.276802
Permissions Required signature permissions-required
https://vuldb.com/?ctiid.276802
Third Party Advisory, VDB Entry third-party-advisory
https://vuldb.com/?submit.401896
Issue Tracking issue-tracking
https://github.com/gouniverse/cms/issues/5

Scores

CVSS v3 3.5
EPSS 0.0040
EPSS Percentile 32.1%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N

CISA SSVC

Vulnrichment
Exploitation none
Automatable no
Technical Impact partial

Details

CWE
CWE-79
Status published
Products (2)
gouniverse/cms 0 - 1.4.1Go
gouniverse/golang_cms < 1.4.1
Published Sep 08, 2024
Tracked Since Feb 18, 2026