Security readout for executives and security teams
Plain-English summary
e107 CMS 3.2.1 allows an administrator to upload SVG files that can contain stored cross-site scripting. The business risk is limited by the need for admin privileges and someone viewing the file, but impact can include script execution in another user’s browser within the site context.
Executive priority
Treat as a moderate-priority web CMS issue. Prioritize if e107 3.2.1 is internet-facing, has many administrators, or hosts sensitive user sessions. No active exploitation is evidenced in the provided sources.
Technical view
CVE-2022-50906 is a CWE-79 stored XSS issue in e107 CMS 3.2.1. An authenticated administrator can bypass upload restrictions through the media manager and store a malicious SVG. When viewed, embedded script may execute. CVSS v4.0 is 4.8, reflecting high privileges required and user interaction.
Likely exposure
Exposure appears limited to e107 CMS version 3.2.1 installations, especially where administrators can upload media files and SVG rendering is allowed or reachable by other users.
Exploitation context
A public ExploitDB entry and VulnCheck advisory exist. The source bundle does not show CISA KEV listing or active exploitation. Exploitation requires authenticated administrator access and a user action to view the uploaded SVG.
Researcher notes
The provided evidence names e107 CMS 3.2.1 only. A public exploit reference exists, but do not infer active exploitation. Fix information is not explicit in the bundle; validate against vendor guidance before declaring remediation complete.
Mitigation direction
- Identify any e107 CMS 3.2.1 deployments.
- Check e107 and advisory sources for upgrade or vendor guidance.
- Restrict administrator access to trusted users only.
- Disable or block SVG uploads/rendering if the platform supports it.
- Remove untrusted SVG files from the media manager.
Validation and detection
- Confirm the running e107 CMS version.
- Review media manager contents for unexpected SVG files.
- Review logs for recent administrator media uploads.
- Verify administrative accounts are authorized and still needed.
- Check the e107 download page for current available versions.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-79: User-session and phishing behavior lookup
Client-side and session-facing weaknesses should be reviewed alongside initial-access and user-execution behaviors. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2022-50906 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Medium
- CVSS
- 4.8 (4.0)
- Known Exploited
- No
- Published
Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N——Primary CVE scoreVulnerability scoring details
Base CVSS 4.0 score
4.8MediumVector: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N
Source materials
- CVE List V5 sourceCVE List V5
- ExploitDB-50910CVE reference · exploit
- Official Vendor HomepageCVE reference · product
- Software Download PageCVE reference · product
- VulnCheck Advisory: e107 CMS v3.2.1 - Admin Upload Restriction Bypass + Stored XSSCVE reference · third-party-advisory
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.