PT-2016-3897

CVE-2015-8376

Publicado

2016-01-08

Atualizado

2020-08-25

Descrição por

CVSS 2.0

4.3

Média

MétricasAV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Symphony CMS version 2.6.3

Description The issue concerns multiple cross-site scripting (XSS) vulnerabilities. These vulnerabilities allow remote attackers to inject arbitrary web script or HTML. The vulnerable parameters include the Name, Navigation Group, and Label parameters to the "blueprints/sections/edit/1" endpoint.

Recommendations For Symphony CMS version 2.6.3, update to a version that includes a fix for this issue. As a temporary workaround, consider restricting input for the Name, Navigation Group, and Label parameters to prevent arbitrary web script or HTML injection until a patch is available.

Explorabilidade

Exploit

Correção

Impactos

Pesquisadores

Sachin Wagh

Tiger_Tigerboy

Fornecedores

Produtos afetados

Enumeração de fraquezas

CWE-79: Improper Neutralization of Input During Web Page Generation (\'Cross-site Scripting\')

Identificadores relacionados