PT-2019-14529
CVE-2019-16130
·
تاريخ النشر
2019-09-09
·
تاريخ التحديث
2019-10-14
الوصف من
CVSS 3.1
6.1
متوسطةالمقاييسAV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Name of the Vulnerable Software and Affected Versions
YII2-CMS version 1.0
Description
The issue concerns a Cross-Site Scripting (XSS) problem. It is located in the protectedcoremoduleshomemodelsContact.php file, specifically via the
name field. This field is vulnerable when accessed through the "/contact.html" API endpoint.Recommendations
For YII2-CMS version 1.0, as a temporary workaround, consider validating and sanitizing the
name field in the Contact.php file to prevent XSS attacks. Restrict access to the "/contact.html" endpoint until a proper fix is applied. At the moment, there is no information about a newer version that contains a fix for this vulnerability.قابلية الاستغلال
استغلال
التأثيرات
الباحثون
المورّدون
المنتجات المتأثرة
وجدت خطأً في الوصف؟ لديك ما تضيفه؟ لا تتردد في مراسلتنا 👾