PT-2017-7490 · Npm+1 · Index Server+1
CVE-2015-8856
·
Published
2016-02-10
·
Updated
2023-09-26
CVSS v3.1
6.1
Medium
| Vector | AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N |
Name of the Vulnerable Software and Affected Versions
serve-index versions 1.6.2 and earlier
Description
A cross-site scripting (XSS) issue allows remote attackers to inject arbitrary web script or HTML via a crafted file or directory name. This is due to file and directory names not being escaped in the module's HTML output, enabling a remote attacker that can influence file or directory names to launch a persistent cross-site scripting attack on the application.
Recommendations
Update to version 1.6.3 or later.
Exploit
Fix
XSS
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Alt Linux
Index Server