CVE-2021-32245 - CVE House
Back to Database
Status published Medium CVE-2021-32245

In PageKit v1.0.18, a user can upload SVG files in...

Vulnerability Description

In PageKit v1.0.18, a user can upload SVG files in the file upload portion of the CMS. These SVG files can contain malicious scripts. This file will be uploaded to the system and it will not be stripped or filtered. The user can create a link on the website pointing to "/storage/exp.svg" that will point to http://localhost/pagekit/storage/exp.svg. When a user comes along to click that link, it will trigger a XSS attack.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2021-32245

Credits & Attribution

No credits recorded in the NVD database.

References

More from pagekit

View All →
CVE-2022-38916
A file upload vulnerability exists in the storage feature of...
Unknown 0
CVE-2022-36573
A cross-site scripting (XSS) vulnerability in Pagekit CMS v1.0.18 allows...
Medium 6.1
CVE-2021-44135
pagekit all versions, as of 15-10-2021, is vulnerable to SQL...
Critical 9.8
CVE-2019-19013
A CSRF vulnerability in Pagekit 1.0.17 allows an attacker to...
High 8.8
CVE-2019-16669
The Reset Password feature in Pagekit 1.0.17 gives a different...
Medium 5.3

Affected Vendor

Affected Software

pagekit
Vulnerable Versions:
1.0.18

Timeline

Official Publish: June 16th, 2021
Last Modified: August 3rd, 2024
Added to House: July 21st, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Weaknesses (CWE)

No CWE data available

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.