Security readout for executives and security teams
Plain-English summary
CVE-2020-18413 is a stored cross-site scripting issue reported in Chaoji CMS v2.18. If an attacker can save malicious content through the nav menu add function, script could later run in another user’s browser. The source bundle does not confirm affected deployments beyond v2.18, authentication requirements, or active exploitation.
Executive priority
Prioritize if Chaoji CMS v2.18 is internet-facing or used by many administrators. Stored XSS can compromise user sessions or administrative actions, but urgency is tempered because the source bundle lacks CVSS, patch status, and active exploitation evidence.
Technical view
The reported vulnerable location is /index.php?admin-master-navmenu-add in Chaoji CMS v2.18. The weakness is described as stored XSS, meaning unsafe input may be persisted and rendered later. CVSS, CWE, fixed versions, and detailed preconditions are not provided in the source bundle.
Likely exposure
Exposure is likely limited to Chaoji CMS v2.18 installations where the nav menu add path is present and reachable. The provided evidence does not establish whether attacker access must be authenticated, administrative, or otherwise privileged.
Exploitation context
The CVE record is not listed in KEV, and the supplied sources do not show active exploitation. The public reference is a GitHub issue. Treat exploitation status as unconfirmed unless newer vendor or threat intelligence evidence is reviewed.
Researcher notes
The record lacks CVSS, CWE, CPE, detailed affected metadata, and remediation details. The title and description identify Chaoji CMS v2.18 and a specific admin nav menu route. Authentication and trigger conditions require confirmation from the GitHub issue or local testing.
Mitigation direction
- Check the Chaoji CMS project or vendor guidance for a fixed release or patch.
- Restrict access to administrative CMS paths to trusted users and networks.
- Review and sanitize stored nav menu input before rendering it in pages.
- Apply output encoding for user-controlled content rendered in CMS templates.
- Use browser-side controls such as CSP as defense in depth.
Validation and detection
- Inventory whether Chaoji CMS v2.18 is deployed anywhere in the environment.
- Confirm whether /index.php?admin-master-navmenu-add exists and is accessible.
- Review roles allowed to create or edit nav menu entries.
- Inspect stored nav menu fields for unexpected script-like content.
- Verify templates encode stored values before rendering them to users.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
Execution behavior lookup
The CVE wording references code or command execution, so execution technique review may help defensive triage. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.
Open ATT&CK lookupCVE-2020-18413 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Unknown
- CVSS
- Not scored
- Known Exploited
- No
- Published
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS and timeline data
No CVSS vectors or timeline events were available in the normalized CVE source material.
Source materials
- CVE List V5 sourceCVE List V5
- https://github.com/GodEpic/chaojicms/issues/5CVE reference
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.