Mezzanine CMS 6.1.0 · Stored Cross Site Scripting (XSS)

Impact

For European organizations using Mezzanine CMS 6.1.0, this vulnerability poses a significant risk to web application security and user trust. Exploitation could lead to unauthorized script execution affecting confidentiality and integrity of user data, including session tokens and personal information. This can result in account takeover, data leakage, or distribution of malware through compromised web pages. The stored nature of the XSS means the malicious payload persists and affects all visitors to the infected blog post, amplifying the attack surface. Organizations in sectors such as media, education, government, and SMEs that rely on Mezzanine CMS for content management are particularly vulnerable. The requirement for admin authentication reduces risk from external anonymous attackers but insider threats or compromised admin credentials could be leveraged. Additionally, the vulnerability could be exploited for phishing campaigns or to bypass security controls like Content Security Policy if improperly configured. The reputational damage and potential regulatory consequences under GDPR for data breaches involving personal data exposure are also considerable.