PT-2017-13827
CVE-2017-15039
·
تاريخ النشر
2017-11-06
·
تاريخ التحديث
2017-11-22
الوصف من
CVSS 3.1
4.8
متوسطةالمقاييسAV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
Name of the Vulnerable Software and Affected Versions
Zurmo version 3.2.1.57987acc3018
Description
A cross-site scripting issue exists due to the improper handling of a data: URL in the
redirectUrl parameter to "app/index.php/meetings/default/createMeeting" API endpoint. This allows for potential exploitation.Recommendations
For Zurmo version 3.2.1.57987acc3018, avoid using the
redirectUrl parameter with data: URLs in the "app/index.php/meetings/default/createMeeting" endpoint until a fix is available. Consider restricting access to this endpoint to minimize the risk of exploitation. وجدت خطأً في الوصف؟ لديك ما تضيفه؟ لا تتردد في مراسلتنا 👾