CVE-2022-37721
CriticalCVSS 9.0Exploitation Probability (EPSS)
Low risk49th percentile - higher than 49% of all known CVEs
Summary
PyroCMS 3.9 is vulnerable to a stored XSS attack, allowing a low-privileged user (e.g., author) to inject malicious HTML and JavaScript into blog post content. This can lead to full admin account takeover or privilege escalation.
Risk Assessment
An attacker can gain full control over an admin account, resulting in unauthorized data access, content modification, or complete compromise of the CMS system.
Recommendation
Immediately upgrade PyroCMS to the latest version that fixes this vulnerability. Additionally, implement input filtering and output encoding for all content fields.
Other vulnerabilities in PyroCMS
See all- CVE-2024-58297Medium
PyroCMS v3.0.1 contains a stored cross-site scripting vulnerability in the admin redirects configuration that allows attackers to inject malicious scripts. A payload in the 'Redirect From' field executes arbitrary JavaScript when administrators view the redirects page.
- CVE-2022-35118Medium
PyroCMS version 3.9 was found to contain multiple cross-site scripting (XSS) vulnerabilities.
Original NVD description (English source)
PyroCMS 3.9 is vulnerable to a stored Cross Site Scripting (XSS_ when a low privileged user such as an author, injects a crafted html and javascript payload in a blog post, leading to full admin account takeover or privilege escalation.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS