CVE-2015-5520

Опубликовано: 14 июл. 2015

Источник: nvd

CVSS2: 4.3

EPSS Низкий

Описание

Cross-site scripting (XSS) vulnerability in the Users module in Orchard 1.7.3 through 1.8.2 and 1.9.x before 1.9.1 allows remote attackers to inject arbitrary web script or HTML via the username when creating a new user account, which is not properly handled when deleting an account.

Ссылки

http://docs.orchardproject.net/Documentation/Patch-20150630
Patch
Vendor Advisory
http://packetstormsecurity.com/files/132583/Orchard-CMS-1.9.0-1.8.2-1.7.3-Cross-Site-Scripting.html
Exploit
http://seclists.org/fulldisclosure/2015/Jul/32
Exploit
https://projectzero.gr/en/2015/07/orchard-persistent-xss-vulnerability/
Exploit
https://www.exploit-db.com/exploits/37533/
Exploit
http://docs.orchardproject.net/Documentation/Patch-20150630
Patch
Vendor Advisory
http://packetstormsecurity.com/files/132583/Orchard-CMS-1.9.0-1.8.2-1.7.3-Cross-Site-Scripting.html
Exploit
http://seclists.org/fulldisclosure/2015/Jul/32
Exploit
https://projectzero.gr/en/2015/07/orchard-persistent-xss-vulnerability/
Exploit
https://www.exploit-db.com/exploits/37533/
Exploit

Уязвимые конфигурации

Конфигурация 1

Одно из

cpe:2.3:a:orchardproject:orchard:1.7.3:*:*:*:*:*:*:*

cpe:2.3:a:orchardproject:orchard:1.8:*:*:*:*:*:*:*

cpe:2.3:a:orchardproject:orchard:1.8.1:*:*:*:*:*:*:*

cpe:2.3:a:orchardproject:orchard:1.8.2:*:*:*:*:*:*:*

cpe:2.3:a:orchardproject:orchard:1.9:*:*:*:*:*:*:*

EPSS

Процентиль: 89%

0.03984

Низкий

4.3 Medium

CVSS2

Дефекты

CWE-79

Связанные уязвимости

GHSA-2f6h-8w7w-4q3g

github

около 4 лет назад