Description (CNA)
Cotonti 1.0.0 (master branch, commit f43f1fc3) is vulnerable to stored Cross-Site Scripting in the Personal File Storage (PFS) module. A folder title (pff_title) is imported with the 'TXT' filter, which does not strip or encode HTML (the tag check in cot_import is disabled), so an authenticated user can store HTML/JavaScript in a folder title.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| Cotonti / Cotonti | affected 1.0.0 |
CWE
CWE-79
References
- https://github.com/Cotonti/Cotonti/blob/f43f1fc38ba4e02027786dad9dac1435c7c52b30/modules/pfs/inc/pfs.main.php#L396
- https://github.com/Cotonti/Cotonti
ADP enrichment
No English description supplied.
No references supplied.