PT-2017-18807 · Andrzuk · Finecms
CVE-2017-9251
·
Published
2017-05-28
·
Updated
2024-02-14
CVSS v2.0
4.3
Medium
| Vector | AV:N/AC:M/Au:N/C:N/I:P/A:N |
Name of the Vulnerable Software and Affected Versions
andrzuk/FineCMS versions prior to 2017-05-28
Description
The issue is related to a reflected XSS in the
sitename parameter to the "admin.php" endpoint.Recommendations
For versions prior to 2017-05-28, as a temporary workaround, consider restricting access to the "admin.php" endpoint until a patch is available. Avoid using the
sitename parameter in the affected endpoint until the issue is resolved.Fix
XSS
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Finecms