CVE-2020-19228

A stored cross-site scripting (XSS) vulnerability in Bludit 4.0.0-beta allows a low-privileged authenticated user (Author role) to inject arbitrary JavaScript by uploading a crafted SVG file as the site logo.

Bludit prior to version 3.22.0 has a vulnerability in the user management logic that allows deactivated accounts to maintain access via persistent authentication tokens. When an administrator disables a user account, the application fails to invalidate or clear the associated tokenAuth and tokenRemember fields in the JSON database. Consequently, any user with a pre-existing "Remember Me" cookie can bypass the account disablement and maintain a valid authenticated state.

Bludit prior to version 3.22.0 has a Broken Access Control flaw where active sessions remain valid even after the user account is deleted from the database. This allows revoked users to maintain unauthorized access.

Bludit 3.16.2 contains a stored XSS vulnerability in the post content functionality. The application performs client-side sanitation but lacks server-side enforcement. An authenticated user can inject arbitrary JavaScript into post content, which is stored and rendered to other users without proper output encoding.

Bludit 3.16.1 has a CSRF vulnerability in the /admin/uninstall-plugin/ and /admin/install-theme/ endpoints. Lack of CSRF tokens or request origin validation allows an attacker to trick an authenticated admin into performing unauthorized actions.