PT-2018-12480

CVE-2018-14382

Publicado

2018-07-18

Atualizado

2018-09-12

Descrição por

CVSS 3.1

6.1

Média

MétricasAV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions InstantCMS version 2.10.1

Description The issue concerns an XSS vulnerability. It is related to the "/redirect?url=" endpoint, which is susceptible to cross-site scripting attacks.

Recommendations For InstantCMS version 2.10.1, consider restricting access to the /redirect?url= endpoint until a patch is available. As a temporary workaround, avoid using the url parameter in the affected endpoint to minimize the risk of exploitation.

Explorabilidade

Exploit

Correção

Impactos

Pesquisadores

Hackyzh

Whitehat001

Fornecedores

Produtos afetados

Enumeração de fraquezas

CWE-79: Improper Neutralization of Input During Web Page Generation (\'Cross-site Scripting\')

Identificadores relacionados