Detections
Analytics

SCA: security update for getkirby/cms (GHSA-2f2w-349x-vrqm)

medium Tenable Cloud Security Plugin ID 408875

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - Kirby is a content management system. In Kirby CMS versions 3.5.5 and 3.5.6, the Panel's `ListItem`
 component (used in the pages and files section for example) displayed HTML in page titles as it is. This
 could be used for cross-site scripting (XSS) attacks. Malicious authenticated Panel users can escalate
 their privileges if they get access to the Panel session of an admin user. Visitors without Panel access
 can use the attack vector if the site allows changing site data from a frontend form. Kirby 3.5.7 patches
 the vulnerability. As a partial workaround, site administrators can protect against attacks from visitors
 without Panel access by validating or sanitizing provided data from the frontend form. (CVE-2021-32735)

See Also

https://github.com/advisories/GHSA-2f2w-349x-vrqm

Plugin Details

Severity: Medium

ID: 408875

Version: Revision 1.6

Type: Local

Family: SCA Checks

Published: 1/23/2025

Updated: 7/2/2026

Supported Sensors: Tenable Cloud Security, Tenable Self-Hosted Container Security

Risk Information

VPR

Risk Factor: Low

Score: 2.3

Percentile: 8.67

Vendor

Vendor Severity: High

CVSS v2

Risk Factor: Low

Base Score: 3.5

Temporal Score: 2.6

Vector: CVSS2#AV:N/AC:M/Au:S/C:N/I:P/A:N

CVSS Score Source: CVE-2021-32735

CVSS v3

Risk Factor: Medium

Base Score: 5.4

Temporal Score: 4.7

Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

Exploit Ease: No known exploits are available

Patch Publication Date: 7/2/2021

Vulnerability Publication Date: 7/2/2021

Reference Information

CVE: CVE-2021-32735

cwe: CWE-80