PT-2018-9976
CVE-2018-10580
·
تاريخ النشر
2018-05-11
·
تاريخ التحديث
2018-06-14
الوصف من
CVSS 3.1
5.4
متوسطةالمقاييسAV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Name of the Vulnerable Software and Affected Versions:
MyBB "Latest Posts on Profile" plugin version 1.1
Description:
The issue arises from the lack of sanitization in the
tsubject field, which is used to display a user's most recent posts on their profile. This allows for XSS attacks.Recommendations:
For MyBB "Latest Posts on Profile" plugin version 1.1, consider disabling the plugin until a patch is available to prevent exploitation. As a temporary workaround, restrict access to the user profile section that displays recent posts to minimize the risk of XSS attacks.
قابلية الاستغلال
استغلال
إصلاح
التأثيرات
المورّدون
المنتجات المتأثرة
وجدت خطأً في الوصف؟ لديك ما تضيفه؟ لا تتردد في مراسلتنا 👾