CVE-2017-16356

Опубликовано: 20 фев. 2018

Источник: nvd

CVSS3: 6.1

CVSS2: 4.3

EPSS Низкий

Описание

Reflected XSS in Kubik-Rubik SIGE (aka Simple Image Gallery Extended) before 3.3.0 allows attackers to execute JavaScript in a victim's browser by having them visit a plugins/content/sige/plugin_sige/print.php link with a crafted img, name, or caption parameter.

Ссылки

http://packetstormsecurity.com/files/146422/Joomla-Kubik-Rubik-SIGE-3.2.3-Cross-Site-Scripting.html
Exploit
Third Party Advisory
VDB Entry
https://www.exploit-db.com/exploits/44104/
Exploit
Third Party Advisory
VDB Entry
http://packetstormsecurity.com/files/146422/Joomla-Kubik-Rubik-SIGE-3.2.3-Cross-Site-Scripting.html
Exploit
Third Party Advisory
VDB Entry
https://www.exploit-db.com/exploits/44104/
Exploit
Third Party Advisory
VDB Entry

Уязвимые конфигурации

Конфигурация 1

cpe:2.3:a:kubik-rubik:simple_image_gallery_extended:*:*:*:*:*:joomla\!:*:*

Версия до 3.3.0 (исключая)

EPSS

Процентиль: 52%

0.00296

Низкий

6.1 Medium

CVSS3

4.3 Medium

CVSS2

Дефекты

CWE-79

Связанные уязвимости

GHSA-mgj8-j4fr-9g5c