PT-2014-5688
CVE-2014-4036
·
تاريخ النشر
2014-06-11
·
تاريخ التحديث
2022-05-17
الوصف من
CVSS 2.0
4.3
متوسطةالمقاييسAV:N/AC:M/Au:N/C:N/I:P/A:N
Name of the Vulnerable Software and Affected Versions
ImpressCMS version 1.3.6.1
Description
A cross-site scripting (XSS) issue exists in the
modules/system/admin.php file, allowing remote attackers to inject arbitrary web script or HTML via the query parameter in a "listimg" action. This could potentially lead to unauthorized access or control of user sessions.Recommendations
For ImpressCMS version 1.3.6.1, consider disabling the
listimg action in the modules/system/admin.php file until a patch is available. Restrict access to the modules/system/admin.php file to minimize the risk of exploitation. Avoid using the query parameter in the affected API endpoint until the issue is resolved. وجدت خطأً في الوصف؟ لديك ما تضيفه؟ لا تتردد في مراسلتنا 👾