Security readout for executives and security teams
Plain-English summary
CVE-2018-1000521 is a reported cross-site scripting issue in BigTree-CMS user creation. A lower-privileged user could potentially target a higher-privileged Developer user. The public data does not provide severity, CVSS, affected versions, or active exploitation evidence.
Executive priority
Treat this as a targeted CMS administration risk, not a confirmed widespread emergency. Prioritize if BigTree-CMS is internet-facing, multi-user, or used by privileged Developer accounts.
Technical view
The vulnerability is described as XSS in BigTree-CMS at /users/create. The source says it appears fixed after commit b652cfdc14d0670c81ac4401ad5a04376745c279, but does not specify the XSS variant, payload location, CWE, CVSS, or affected release range.
Likely exposure
Exposure is most likely limited to BigTree-CMS deployments running code before the referenced fix, especially where lower-privileged authenticated users can access /users/create and privileged Developer users interact with affected content.
Exploitation context
The source bundle does not show CISA KEV listing or other evidence of active exploitation. Public information only supports that the issue was disclosed in GitHub and described as affecting privilege-separated BigTree-CMS users.
Researcher notes
Evidence is sparse. The CVE entry names BigTree-CMS and /users/create, but omits affected versions, CVSS, CWE, and exploit details. Avoid assuming exploitability beyond the low-privileged-to-Developer XSS scenario stated in the source.
Mitigation direction
- Inventory BigTree-CMS deployments and versions.
- Update to a vendor-supported release containing the referenced fix.
- Confirm whether commit b652cfdc14d0670c81ac4401ad5a04376745c279 is present.
- Restrict /users/create access to trusted administrators until remediated.
- Review vendor guidance for exact affected versions and controls.
Validation and detection
- Check whether BigTree-CMS is deployed in production or staging.
- Verify whether /users/create is reachable by low-privileged authenticated users.
- Confirm the deployed code includes the referenced fixing commit.
- Review logs for unusual /users/create access or privileged account activity.
- Document uncertainty because affected versions and CVSS are not published here.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2018-1000521 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Unknown
- CVSS
- Not scored
- Known Exploited
- No
- Published
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS and timeline data
No CVSS vectors or timeline events were available in the normalized CVE source material.
Source materials
- CVE List V5 sourceCVE List V5
- https://github.com/bigtreecms/BigTree-CMS/issues/328CVE reference · x_refsource_MISC
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.