CVE-2020-35275
MediumCVSS 5.4Exploitation Probability (EPSS)
Elevated risk60th percentile - higher than 60% of all known CVEs
Summary
CoasterCMS version 5.8.18 is vulnerable to Cross-Site Scripting (XSS). An attacker can steal a user's session cookie and redirect them to a malicious website, as the vulnerability is triggered on the main home page of the application.
Risk Assessment
The risk involves session hijacking and redirection to malicious sites, potentially leading to data theft or further attacks.
Recommendation
Update CoasterCMS to the latest patched version immediately and implement XSS protections such as output encoding and Content Security Policy headers.
Original NVD description (English source)
Coastercms v5.8.18 is affected by cross-site Scripting (XSS). A user can steal a cookie and make the user redirect to any malicious website because it is trigged on the main home page of the product/application.