CVE-2018-20682

Description

Fork CMS 5.0.6 allows stored XSS via the `private/en/settings` `facebook_admin_ids` parameter (aka "Admin ids" input in the Facebook section).

How to fix CVE-2018-20682

No fixed version has been published yet. Mitigate by removing the affected package or applying upstream guidance from the references below.

• Packagist/forkcms/forkcms—no fix listed

Is CVE-2018-20682 being exploited?

Low — EPSS is 0.2%, meaning exploitation activity has not been observed at scale.

Affected packages (1)

• from 0, <= 5.0.6

CVSS scores

References (3)

• ADVISORYnvd.nist.gov/vuln/detail/CVE-2018-20682
• PATCHgithub.com/forkcms/forkcms
• WEBwww.netsparker.com/web-applications-advisories/ns-18-032-stored-cross-site-scripting-in-forkcms