ADVISORIES

• CVE-2018-18260 (NVD)
• GHSA-7f84-9cqf-g4j9
• Vendor Advisory

GEM

camaleon_cms

SEVERITY

CVSS v3.x: 6.1 (Medium)

UNAFFECTED VERSIONS

• < 2.4

PATCHED VERSIONS

None.

DESCRIPTION

In the 2.4 version of Camaleon CMS, Stored XSS has been discovered. The profile image in the User settings section can be run in the update / upload area via /admin/media/upload?actions=false.