CVE-2022-37720
CriticalCVSS 9.0Exploitation Probability (EPSS)
Elevated risk51th percentile - higher than 51% of all known CVEs
Summary
Orchard CMS 1.10.3 is vulnerable to Cross-Site Scripting (XSS). A low-privileged user (author or publisher) can inject malicious HTML and JavaScript into a blog post, leading to full admin account takeover or privilege escalation when the post is viewed by an administrator.
Risk Assessment
An attacker can gain full control over the admin account, accessing all system functions and data, posing a serious threat to confidentiality and integrity.
Recommendation
Immediately update Orchard CMS to the latest available version that fixes this vulnerability and implement input filtering and encoding mechanisms.
Original NVD description (English source)
Orchardproject Orchard CMS 1.10.3 is vulnerable to Cross Site Scripting (XSS). When a low privileged user such as an author or publisher, injects a crafted html and javascript payload in a blog post, leading to full admin account takeover or privilege escalation when the malicious blog post is loaded in the victim's browser.