April 11, 2024
Join our followers
Cross-Site Scripting (XSS) in Twilight CMS
| Advisory ID: | HTB23166 |
| Product: | Twilight CMS |
| Vendor: | Strata Technologies LLC |
| Vulnerable Versions: | 5.17 and probably prior |
| Tested Version: | 5.17 |
| Advisory Publication: | July 24, 2013 [without technical details] |
| Vendor Notification: | July 24, 2013 |
| Vendor Fix: | August 15, 2013 |
| Public Disclosure: | August 21, 2013 |
| Latest Update: | August 17, 2013 |
| Vulnerability Type: | Cross-Site Scripting [CWE-79] |
| CVE Reference: | CVE-2013-4899 |
| Risk Level: | Medium |
 | |
| CVSSv2 Base Score: | 4.3 (AV:N/AC:M/Au:N/C:N/I:P/A:N) |
| Solution Status: | Fixed by Vendor |
| Discovered and Provided: | High-Tech Bridge Security Research Lab |
| Advisory Details: | |
High-Tech Bridge Security Research Lab discovered vulnerability in Twilight CMS, which can be exploited to perform Cross-Site Scripting (XSS) attacks. | |
| Solution: | |
| The only version of Twilight CMS publicly available for download on the 24th of July (Vendor notification date) was 5.17. Vendor didn't reply to 12 notifications, however silently patched the vulnerability in version 5.24, which is now available for download on www.twl.ru (Russian version of Vendor website). Update to version 5.24. | |
References: | |
| [1] High-Tech Bridge Advisory HTB23166 - https://www.immuniweb.com/advisory/HTB23166 - Cross-Site Scripting (XSS) in Twilight CMS. [2] Twilight CMS - http://www.twilightcms.com/ - Twilight CMS is a convenient content management system. [3] Common Vulnerabilities and Exposures (CVE) - http://cve.mitre.org/ - international in scope and free for public use, CVE® is a dictionary of publicly known information security vulnerabilities and exposures. [4] Common Weakness Enumeration (CWE) - http://cwe.mitre.org - targeted to developers and security practitioners, CWE is a formal list of software weakness types. | |
Previous Security Advisories with CWE-79:
Have additional information to submit?
Please feel free to send us any additional information related to this Advisory, such as vulnerable versions, additional exploitation details and conditions, patches and other relevant details.
Please feel free to send us any additional information related to this Advisory, such as vulnerable versions, additional exploitation details and conditions, patches and other relevant details.
