CVE-2019-15483

Vulnerability

Overview

CVE-2019-15483 is a stored cross-site scripting (XSS) vulnerability in Bolt CMS versions prior to 3.6.10. The root cause is improper sanitization of user-supplied title input when it is written to the system log. When a title containing malicious JavaScript is saved, it is later rendered unsanitized in the system log viewer, leading to script execution [1][2].

Exploitation

Prerequisites

An attacker must have authenticated access to Bolt and the ability to create or edit content that includes a title field. The malicious title is stored and subsequently displayed in the system log, which is typically accessed by administrators. No additional privileges beyond basic content creation are required [2][4].

Impact

Successful exploitation allows an attacker to execute arbitrary JavaScript in the context of an administrator's session. This can lead to session hijacking, theft of sensitive data, or further compromise of the CMS instance. The vulnerability is classified as a security issue and was responsibly disclosed [4].

Mitigation

The vulnerability is fixed in Bolt version 3.6.10, released on August 15, 2019. Users are strongly advised to upgrade to this version or later. No workarounds are documented [4].