CVE-2014-7264

Опубликовано: 11 дек. 2014

Источник: nvd

CVSS2: 3.5

EPSS Низкий

Описание

Multiple cross-site scripting (XSS) vulnerabilities in admin/themes/default/pages/manage_users.twig in the Users Management feature in the admin component in Chyrp before 2.5.1 allow remote authenticated users to inject arbitrary web script or HTML via the (1) user.email or (2) user.website field in a user registration.

Ссылки

http://chyrp.net/2014/11/18/chyrp-251-security-release/
Vendor Advisory
http://jvn.jp/en/jp/JVN13160869/index.html
Vendor Advisory
http://jvndb.jvn.jp/jvndb/JVNDB-2014-000149
Vendor Advisory
https://github.com/chyrp/chyrp/commit/43d1b6b266363ae7545d5d49851034eaeec7bebb
Vendor Advisory
http://chyrp.net/2014/11/18/chyrp-251-security-release/
Vendor Advisory
http://jvn.jp/en/jp/JVN13160869/index.html
Vendor Advisory
http://jvndb.jvn.jp/jvndb/JVNDB-2014-000149
Vendor Advisory
https://github.com/chyrp/chyrp/commit/43d1b6b266363ae7545d5d49851034eaeec7bebb
Vendor Advisory

Уязвимые конфигурации

Конфигурация 1

cpe:2.3:a:chyrp:chyrp:*:*:*:*:*:*:*:*

Версия до 2.5 (включая)

EPSS

Процентиль: 40%

0.0018

Низкий

3.5 Low

CVSS2

Дефекты

CWE-79

Связанные уязвимости

CVE-2014-7264

debian

около 11 лет назад

Multiple cross-site scripting (XSS) vulnerabilities in admin/themes/de ...

GHSA-4wpp-v97f-6975

github

больше 3 лет назад