Quick answers
- Is CVE-2019-10260 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2019-10260 being exploited in the wild.
- How severe is CVE-2019-10260?
- Low severity, with a CVSS score of 3, published 2 April 2019.
- Which products and versions are affected?
- total.js (npm) SEMVER:introduced=0,fixed=3.3.0-13.
- Is there a fix for CVE-2019-10260?
- Yes. total.js (npm): upgrade to 3.3.0-13 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2019-10260 attacked?
- It is attacked over the network, in a software library.
- Am I affected by CVE-2019-10260?
- Check whether you run total.js (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
How to fix
- total.js (npm): upgrade to 3.3.0-13 or later
npm install total.js@3.3.0-13
Technical details
Two cross-site scripting (CWE-79) vulnerabilities exist in Total.js CMS 12.0.0: one in themes/admin/views/index.html affecting item.message, and another in themes/admin/public/ui.js affecting column.format. These vulnerabilities occur because user-controlled input is not properly sanitized before being reflected in HTML output. An attacker must use social engineering or account compromise to inject malicious JavaScript, but no additional authentication beyond basic admin panel access is required. Successful exploitation allows execution of arbitrary JavaScript in the context of the admin interface, potentially leading to session hijacking, credential theft, or administrative action abuse. The vulnerability was patched in version 3.3.0-13, as evidenced by commits fixing XSS output encoding in the affected components.
Affected products
- Total.js CMS <3.3.0-13
Identifiers
- CVE-2019-10260
- GHSA-72p5-2r6g-fm6v
Timeline
- 2019-04-02: disclosed
- 2019-04-02: patched: Fixed in version 3.3.0-13