XSS in Getkirby Kirby
CVE-2022-36037
kirby is a content management system (CMS) that adapts to many different projects and helps you build your own ideal interface. Cross-site scripting (XSS) is a type of vulnerability that allows execution of any kind of JavaScript code inside the Panel session of the same or other users. In the Panel, a harmful script can for example trigger requests to Kirby's API with the permissions of the victim. If bad actors gain access to your group of authenticated Panel users they can escalate their privileges via the Panel session of an admin user. Depending on your site, other JavaScript-powered attacks are possible. The multiselect field allows selection of tags from an autocompleted list. Unfortunately, the Panel in Kirby 3.5 used HTML rendering for the raw option value. This allowed **attackers with influence on the options source** to store HTML code. The browser of the victim who visited a page with manipulated multiselect options in the Panel will then have rendered this malicious HTML code when the victim opened the autocomplete dropdown. Users are *not* affected by this vulnerability if you don't use the multiselect field or don't use it with options that can be manipulated by attackers. The problem has been patched in Kirby 3.5.8.1.
Vulnerability class: XSS (Cross-Site Scripting)
Published · last modified .
CVSS v3 metric
CVSS v3 base score 5.9 (Medium). Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:N.
EPSS exploit prediction
EPSS: 0.009 (58.1th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 58th percentile — 58.1% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.009 · newest: 0.009 · change: +0.000
Affected products
- Getkirby Kirby — versions < 3.5.8.1
Weakness classification (CWE)
References
- github.com/getkirby/kirby/security/advisories/GHSA-3f89-869f-5w76 (Patch, Third Party Advisory)
- github.com/getkirby/kirby/commit/b5b8863885e17556abc070dde1e20aec15fbfdf5 (Patch, Third Party Advisory)
- github.com/getkirby/kirby/releases/tag/3.5.8.1 (Third Party Advisory, Release Notes)
Frequently asked questions
- What is CVE-2022-36037?
- CVE-2022-36037 is a medium-severity vulnerability in Getkirby Kirby, classified under Cross-site Scripting. CVSS score: 5.9/10. Published 2022-08-29.
- How severe is CVE-2022-36037?
- Medium severity. CVSS v3 base score is 5.9 out of 10.