CVE-2021-25969 — Vulnerability in camaleon_cms — CVE Details

MEDIUM

Camaleon CMS Stored Cross-site Scripting vulnerability

Published May 24, 2022Updated November 8, 2023Source: osv

Summary

In “Camaleon CMS” application, versions 0.0.1 through 2.6.0 are vulnerable to stored XSS, that allows unprivileged application users to store malicious scripts in the comments section of the post. These scripts are executed in a victim’s browser when they open the page containing the malicious comment.

Advisory Timeline

First published May 24, 2022 (1602 days ago).
Last revised November 8, 2023 — 532 days after initial publication.

Remediation

Upgrade to the fixed version using your package manager.

Bundler

Update camaleon_cms to 2.6.0.1 or later

gem install camaleon_cms -v 2.6.0.1

After upgrading, run your dependency scanner again to confirm the vulnerability is resolved.

Affected Packages (1)

Affects 1 ecosystem: rubygems (1).

Package	Ecosystem	Affected	Fixed In
camaleon_cms	rubygems	0.0.1, 0.0.2, 0.1.2, 0.1.3 (+96 more)	2.6.0.1

Vulnerability Classification

Common Weakness Enumeration (CWE) identifiers for this vulnerability type.

CWE-79
Cross-site Scripting (XSS)MITRE

CVSS Score Breakdown

What the CVSS (Common Vulnerability Scoring System) 6.1 score means for each attack dimension.

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

References

Frequently Asked Questions

What is CVE-2021-25969?: Camaleon CMS Stored Cross-site Scripting vulnerability This vulnerability has been assigned a severity rating of MEDIUM (CVSS score: 6.1/10).
How do I check if my project is affected by CVE-2021-25969?: CVE-2021-25969 affects camaleon_cms. Use GeekWala's free vulnerability scanner to check your dependencies against CVE-2021-25969 and 200,000+ other known vulnerabilities.

Severity & Exploitability

CVSS Score

6.1

Exploitation requires specific conditions or has limited impact. Remediate within weeks.

Also Known As

GHSA-x78v-4fvj-rg9j

Related CVEs

CVE-2025-2304
CRITICAL
Camaleon CMS Vulnerable to Privilege Escalation through a Mass Assignment
CVE-2023-30145
CRITICAL
Server-Side Template Injection in Camaleon CMS
CVE-2021-25970
HIGH
Camaleon CMS Insufficient Session Expiration vulnerability
GHSA-7x4w-cj9r-h4v9
HIGH
Camaleon CMS vulnerable to remote code execution through code injection (GHSL-2024-185)
CVE-2024-46987
HIGH
Camaleon CMS vulnerable to arbitrary path traversal (GHSL-2024-183)
CVE-2024-46986
HIGH
Camaleon CMS affected by arbitrary file write to RCE (GHSL-2024-182)
CVE-2018-18260
MEDIUM
Camaleon CMS vulnerable to Stored Cross-site Scripting
CVE-2026-1776
MEDIUM
Camaleon CMS vulnerable to Path Traversal through AWS S3 uploader implementation

Check if you're affected

Scan your dependencies to see if this vulnerability affects your projects.

Scan Your Dependencies