CVE-2016-4875

Опубликовано: 14 апр. 2017

Источник: nvd

CVSS3: 6.1

CVSS2: 4.3

EPSS Низкий

Описание

Multiple cross-site scripting (XSS) vulnerabilities in the IVYWE (1) Assist plugin before 1.1.2.test20160906, (2) dataBox plugin before 0.0.0.20160906, and (3) userBox plugin before 0.0.0.20160906 for Geeklog allow remote attackers to inject arbitrary web script or HTML via unspecified vectors.

Ссылки

http://jvn.jp/en/jp/JVN46087986/index.html
Third Party Advisory
VDB Entry
http://jvndb.jvn.jp/en/contents/2016/JVNDB-2016-000167.html
Third Party Advisory
VDB Entry
http://www.securityfocus.com/bid/93123
Third Party Advisory
VDB Entry
https://github.com/ivywe/geeklog-ivywe/commit/3cdb4ebca5746ff1e02b7e434d5722044d1d09d1
Patch
Third Party Advisory
https://github.com/ivywe/geeklog-ivywe/commit/fe20a1bccdfec96125ab3d8dbee6ccbd0767c0be
Patch
Third Party Advisory
http://jvn.jp/en/jp/JVN46087986/index.html
Third Party Advisory
VDB Entry
http://jvndb.jvn.jp/en/contents/2016/JVNDB-2016-000167.html
Third Party Advisory
VDB Entry
http://www.securityfocus.com/bid/93123
Third Party Advisory
VDB Entry
https://github.com/ivywe/geeklog-ivywe/commit/3cdb4ebca5746ff1e02b7e434d5722044d1d09d1
Patch
Third Party Advisory
https://github.com/ivywe/geeklog-ivywe/commit/fe20a1bccdfec96125ab3d8dbee6ccbd0767c0be
Patch
Third Party Advisory

Уязвимые конфигурации

Конфигурация 1

Одно из

cpe:2.3:a:assist_project:assist_plugin:*:*:*:*:*:geeklog:*:*

Версия до 1.1.0 (включая)

cpe:2.3:a:databox_project:databox_plugin:*:*:*:*:*:geeklog:*:*

Версия до 0..0.0.20150609 (включая)

cpe:2.3:a:userbox_project:userbox_plugin:*:*:*:*:*:geeklog:*:*

Версия до 0.0.0.20150918 (включая)

EPSS

Процентиль: 69%

0.00601

Низкий

6.1 Medium

CVSS3

4.3 Medium

CVSS2

Дефекты

CWE-79

Связанные уязвимости

GHSA-4pqq-jprg-84vh