Skip to content
Sign in
Not rated

CVE-2022-23049 Exponent CMS 2.6.0patch2 allows an authenticated user to inject persistent JavaScript code on the "User-Agent" header…

Description

Exponent CMS 2.6.0patch2 allows an authenticated user to inject persistent JavaScript code on the "User-Agent" header when logging in. When an administrator user visits the "User Sessions" tab, the JavaScript will be triggered allowing an attacker to compromise the administrator session.

Affected products and versions

Product Affected versions Fixed in
Exponent CMS 2.6.0patch2 No fix stated

Other CVEs of Exponent CMS

The 3 CVEs of Exponent CMS →
CVE-2022-23048 Exponent CMS 2.6.0patch2 allows an authenticated admin user to upload a malicious extension in the format of a ZIP… Not rated CVE-2022-23047 Exponent CMS 2.6.0patch2 allows an authenticated admin user to inject persistent JavaScript code inside the… Not rated
Track this CVE