PT-2019-18450

CVE-2019-7170

Publicado

2019-01-29

Atualizado

2022-05-14

Descrição por

CVSS 3.1

4.8

Média

MétricasAV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Croogo versions prior to 3.0.6

Description A stored-self XSS issue exists, allowing an attacker to execute HTML or JavaScript code in a vulnerable Title field to "/admin/taxonomy/vocabularies".

Recommendations For versions prior to 3.0.6, update to a version that contains a fix for this issue. As a temporary workaround, consider restricting access to the "/admin/taxonomy/vocabularies" endpoint until a patch is available. Avoid using the Title field in the affected endpoint until the issue is resolved.

Explorabilidade

Exploit

Correção

Impactos

Pesquisadores

Segfaultmaster

Fornecedores

Produtos afetados

Enumeração de fraquezas

CWE-79: Improper Neutralization of Input During Web Page Generation (\'Cross-site Scripting\')

Identificadores relacionados

CVE-2019-7170