CVE-2017-11198

Name of the Vulnerable Software and Affected Versions FineCMS versions prior to 2017-07-12

Description A cross-site scripting (XSS) issue allows remote attackers to inject arbitrary web script or HTML via the folder, id, or name parameter in the /application/lib/ajax/get image.php API endpoint.

Recommendations For versions prior to 2017-07-12, as a temporary workaround, consider restricting access to the /application/lib/ajax/get image.php endpoint until a patch is available. Avoid using the folder, id, or name parameters in this endpoint until the issue is resolved.