CVE-2015-6810

Опубликовано: 04 сент. 2015

Источник: nvd

CVSS2: 3.5

EPSS Низкий

Описание

Cross-site scripting (XSS) vulnerability in Invision Power Services IPS Community Suite (aka Invision Power Board, IPB, or Power Board) 4.x before 4.0.12.1 allows remote authenticated users to inject arbitrary web script or HTML via the event_location[address] array parameter to calendar/submit/.

Ссылки

https://community.invisionpower.com/release-notes/40121-r22/
Vendor Advisory
https://www.exploit-db.com/exploits/37989/
Exploit
https://community.invisionpower.com/release-notes/40121-r22/
Vendor Advisory
https://www.exploit-db.com/exploits/37989/
Exploit

Уязвимые конфигурации

Конфигурация 1

Одно из

cpe:2.3:a:invisionpower:invision_power_board:4.0.0:*:*:*:*:*:*:*

cpe:2.3:a:invisionpower:invision_power_board:4.0.1:*:*:*:*:*:*:*

cpe:2.3:a:invisionpower:invision_power_board:4.0.2:*:*:*:*:*:*:*

cpe:2.3:a:invisionpower:invision_power_board:4.0.3:*:*:*:*:*:*:*

cpe:2.3:a:invisionpower:invision_power_board:4.0.4:*:*:*:*:*:*:*

cpe:2.3:a:invisionpower:invision_power_board:4.0.5.1:*:*:*:*:*:*:*

cpe:2.3:a:invisionpower:invision_power_board:4.0.6.1:*:*:*:*:*:*:*

cpe:2.3:a:invisionpower:invision_power_board:4.0.7:*:*:*:*:*:*:*

cpe:2.3:a:invisionpower:invision_power_board:4.0.8:*:*:*:*:*:*:*

cpe:2.3:a:invisionpower:invision_power_board:4.0.8.1:*:*:*:*:*:*:*

cpe:2.3:a:invisionpower:invision_power_board:4.0.9.2:*:*:*:*:*:*:*

cpe:2.3:a:invisionpower:invision_power_board:4.0.10.2:*:*:*:*:*:*:*

cpe:2.3:a:invisionpower:invision_power_board:4.0.11:*:*:*:*:*:*:*

cpe:2.3:a:invisionpower:invision_power_board:4.0.12:*:*:*:*:*:*:*

EPSS

Процентиль: 56%

0.0034

Низкий

3.5 Low

CVSS2

Дефекты

CWE-79

Связанные уязвимости

GHSA-cxwq-372h-pr95

github

больше 3 лет назад