PT-2018-13706
CVE-2018-16729
·
تاريخ النشر
2018-09-12
·
تاريخ التحديث
2018-11-09
الوصف من
CVSS 3.1
5.4
متوسطةالمقاييسAV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Name of the Vulnerable Software and Affected Versions
Pluck version 4.7.7
Description
The issue allows for XSS (Cross-Site Scripting) attacks via an SVG file containing Javascript in a SCRIPT element. This file can be uploaded through the 'pages->manage' section under the 'admin.php?action=files' endpoint.
Recommendations
For Pluck version 4.7.7, consider restricting access to the file upload functionality under 'admin.php?action=files' to minimize the risk of exploitation. As a temporary workaround, avoid using the file upload feature in the 'pages->manage' section until a patch is available.
قابلية الاستغلال
استغلال
إصلاح
التأثيرات
الباحثون
المورّدون
المنتجات المتأثرة
وجدت خطأً في الوصف؟ لديك ما تضيفه؟ لا تتردد في مراسلتنا 👾