A stored Cross-Site Scripting vulnerability in MCMS versions 6.1.1 through 6.2.1 allows authenticated attackers to execute malicious scripts, posing a high risk to user session integrity.

This is a stored Cross-Site Scripting (XSS) flaw occurring because the article content field, specifically the contentDetails parameter, is excluded from the application global XSS filter. The vulnerability requires the attacker to have at least low-level privileges to submit content.

Successful exploitation allows an attacker to inject malicious scripts that execute in the context of other users, including administrators, when they view the affected content. This can lead to session hijacking, unauthorized actions performed on behalf of legitimate users, and potential data theft. Given the CVSS score of 8.7, this vulnerability is categorized as high severity and requires prompt attention to protect administrative accounts and sensitive site data.

Immediate Action: Since no specific patch version is currently identified, verify if the vendor has released an updated build or security hotfix for the 6.x branch. In the absence of an official patch, restrict administrative content creation privileges to trusted users only.

Proactive Monitoring: Review web server and application access logs for suspicious input patterns or unusual script tags within the contentDetails parameter. Monitor for anomalous administrative account activity that may indicate a session compromise.

Compensating Controls: Implement or tune a Web Application Firewall (WAF) to inspect the contentDetails parameter for malicious script patterns. Ensure that HttpOnly and Secure flags are enabled on all session cookies to mitigate the impact of potential session hijacking.

Public Exploit Available: Unknown.

Organizations utilizing MCMS 6.1.1 through 6.2.1 must prioritize the identification of a vendor-supplied update. Until a patch is confirmed and applied, restrict access to content management modules and deploy WAF rules to sanitize the contentDetails input. Failure to address this flaw could lead to full administrative account takeover.