CVE-2024-51229
Published: 09 January 2025
Description
Cross Site Scripting vulnerability in LinZhaoguan pb-cms v.2.0 allows a remote attacker to execute arbitrary code via the theme management function.
Security Summary
CVE-2024-51229 is a Cross-Site Scripting (XSS) vulnerability, mapped to CWE-79, affecting LinZhaoguan pb-cms version 2.0. The issue exists in the theme management function, where a remote attacker can execute arbitrary code.
With a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H), the vulnerability can be exploited by a remote attacker requiring no privileges over the network with low attack complexity, though user interaction is necessary. Successful exploitation enables high-impact effects on confidentiality, integrity, and availability, allowing arbitrary code execution.
Mitigation details are provided in the advisory at https://gitee.com/LinZhaoguan/pb-cms/issues/IAYHUP.
Details
- CWE(s)