Description
Flextype CMS versions 0.9.9 through 1.0.0-alpha.3 fail to HTML-escape plugin directory names in the dependency error page rendered by getValidPluginsDependencies(). Attackers with write access to the plugins directory can create a plugin with HTML characters in its name to execute arbitrary scripts in users' browsers when dependency validation fails.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
flextype flextype
Default version status: unaffected
0.9.9 to ≤ 1.0.0-alpha.3affected
pkg:composer/flextype/flextypeReferences
- https://github.com/flextype/flextype/issues/597 ↗
- https://github.com/flextype/flextype ↗
- https://github.com/flextype/flextype/blob/aea4ead8c449ea5517ed53b6dcbd28b0a528ad9d/src/flextype/core/Plugins.php#L345 ↗
- https://www.vulncheck.com/advisories/flextype-cms-0.9.9-through-1.0.0-alpha.3-stored-xss-via-plugin-directory ↗