PT-2022-7906
CVE-2017-20033
·
Published
2022-06-10
·
Updated
2022-06-17
Description by
CVSS 3.1
6.1
MediumMetricsAV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Name of the Vulnerable Software and Affected Versions
PHPList versions 3.2.6
Description
A problematic issue has been found in PHPList, affecting an unknown part of the file /lists/admin/. The manipulation of the
page argument with the input send'";><script>alert(8)</script> leads to cross site scripting (Reflected). It is possible to initiate the attack remotely.Recommendations
For PHPList version 3.2.6, upgrade to version 3.3.1 to address this issue. As a temporary workaround, consider restricting access to the
/lists/admin/ endpoint until the upgrade is applied.Exploitability
Exploit
Fix
Impacts
Researchers
Vendors
Affected products
Found an issue in the description? Have something to add? Feel free to write us 👾