CVE-2017-6537

Name of the Vulnerable Software and Affected Versions webpagetest version 3.0

Description A Cross-Site Scripting (XSS) issue exists due to insufficient filtration of user-supplied data, specifically the bgcolor variable, passed to the "webpagetest-master/www/video/view.php" URL. This allows an attacker to execute arbitrary HTML and script code in a browser in the context of the vulnerable website.

Recommendations For webpagetest version 3.0, consider restricting access to the "webpagetest-master/www/video/view.php" URL until a patch is available, and avoid using the bgcolor variable in this context to minimize the risk of exploitation.