CVE-2013-3484

Опубликовано: 02 апр. 2014

Источник: nvd

CVSS2: 4.3

EPSS Низкий

Описание

Multiple cross-site scripting (XSS) vulnerabilities in dotCMS before 2.3.2 allow remote attackers to inject arbitrary web script or HTML via the (1) _loginUserName parameter to application/login/login.html, (2) my_account_login parameter to c/portal_public/login, or (3) email parameter to forgotPassword.

Ссылки

http://dotcms.com/security/SI-14
Exploit
Vendor Advisory
http://secunia.com/advisories/53265
Vendor Advisory
https://github.com/dotCMS/dotCMS/issues/2949
http://dotcms.com/security/SI-14
Exploit
Vendor Advisory
http://secunia.com/advisories/53265
Vendor Advisory
https://github.com/dotCMS/dotCMS/issues/2949

Уязвимые конфигурации

Конфигурация 1

Одно из

cpe:2.3:a:dotcms:dotcms:*:*:*:*:*:*:*:*

Версия до 2.3.1 (включая)

cpe:2.3:a:dotcms:dotcms:1.9.5.1:*:*:*:*:*:*:*

cpe:2.3:a:dotcms:dotcms:2.0:*:*:*:*:*:*:*

cpe:2.3:a:dotcms:dotcms:2.0.1:*:*:*:*:*:*:*

cpe:2.3:a:dotcms:dotcms:2.1:*:*:*:*:*:*:*

cpe:2.3:a:dotcms:dotcms:2.1.1:*:*:*:*:*:*:*

cpe:2.3:a:dotcms:dotcms:2.2:*:*:*:*:*:*:*

cpe:2.3:a:dotcms:dotcms:2.2.1:*:*:*:*:*:*:*

cpe:2.3:a:dotcms:dotcms:2.3:*:*:*:*:*:*:*

EPSS

Процентиль: 55%

0.00322

Низкий

4.3 Medium

CVSS2

Дефекты

CWE-79

Связанные уязвимости

GHSA-gxmx-6pmw-w4w5

github

больше 3 лет назад