Severity Scores
CVSS v36.1
CVSS v20.0
Priority Score266.0
EPSS Score0.0
Medium
Exploitation LikelihoodMinimal
0.00%EPSS
Very low probability of exploitation
Monitor and patch as resources allow
0.00%
EPSS
6.1
CVSS
Yes
Exploit
Yes
Patch
Medium Priority
exploit exists
EPSS predicts the probability of exploitation in the next 30 days based on real-world threat data, complementing CVSS severity scores with actual risk assessment.
Description
Summary
All pages within the HAX CMS application do not contain headers to stop other websites from loading the site within an iframe. This applies to both the CMS and generated sites.
PoC
To replicate this vulnerability, load the target page in an iframe and observe the rendered content.
Impact
An unauthenticated attacker can load the standalone login page or other sensitive functionality within an iframe, performing a UI redressing attack (Clickjacking). This can be used to perform social engineering attacks to attempt to coerce users into performing unintended actions within the HAX CMS application.
CVSS v3 Breakdown
Attack Vector:Network
Attack Complexity:Local
Privileges Required:Network
User Interaction:Required
Scope:Changed
Confidentiality:Local
Integrity:Local
Availability:Network
Exploit References
Patch References
Trend Analysis
Neutral
Vulnerable Products
| Vendor | Product |
|---|---|
| Psu | Haxcms Node.js |
| Psu |