PT-2021-22929
CVE-2021-40541
·
تاريخ النشر
2021-10-11
·
تاريخ التحديث
2021-10-15
الوصف من
CVSS 3.1
6.1
متوسطةالمقاييسAV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Name of the Vulnerable Software and Affected Versions
PHPFusion version 9.03.110
Description
The issue is related to cross-site scripting (XSS) in the preg patterns filter html tag without "//" in the
descript() function. An authenticated user can trigger XSS by appending "//" at the end of the text.Recommendations
For PHPFusion version 9.03.110, consider disabling the
descript() function until a patch is available to prevent exploitation. Restrict access to the html tag filter to minimize the risk of XSS attacks. Avoid appending "//" at the end of text in the affected function to prevent triggering the issue.قابلية الاستغلال
استغلال
إصلاح
التأثيرات
الباحثون
المورّدون
المنتجات المتأثرة
وجدت خطأً في الوصف؟ لديك ما تضيفه؟ لا تتردد في مراسلتنا 👾