CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L
What the vulnerability does
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Interfacelab Media Cloud for Amazon S3, Imgix, Google Cloud Storage, DigitalOcean Spaces and more allows Stored XSS.This issue affects Media Cloud for Amazon S3, Imgix, Google Cloud Storage, DigitalOcean Spaces and more: from n/a through 4.5.24.
Explanation of Vulnerability in Simple Terms
Media Cloud contains a cross-site scripting vulnerability in its admin interface. An authenticated user with low privileges can inject malicious scripts that execute in the browsers of other site administrators. The vulnerability requires the victim to interact with a crafted link or page. Successful exploitation allows reading sensitive data, modifying site content, or performing actions as the admin.
What an attacker can do
Inject malicious scripts that run in admin browsers, stealing data or performing unauthorized actions.
Potential impact on your site
Admins visiting malicious links could have their sessions compromised or site settings altered without their knowledge.
Conditions required to exploit
Attacker needs a low-privilege account; victim admin must click a malicious link or visit a crafted page.
Key dates
External resources
Related vulnerabilities
