CVE-2017-17792

Опубликовано: 20 дек. 2017

Источник: nvd

CVSS3: 6.1

CVSS2: 4.3

EPSS Низкий

Описание

Cross site scripting (XSS) vulnerability in the markup_clean_href function in inc/conv.php in BlogoText through 3.7.6 allows remote attackers to inject arbitrary JavaScript via a comment.

Ссылки

https://github.com/BlogoText/blogotext/commit/7c6f74e43008b2397160775696c67acbab87911d
Patch
https://github.com/BlogoText/blogotext/issues/345
Issue Tracking
Third Party Advisory
https://github.com/BlogoText/blogotext/commit/7c6f74e43008b2397160775696c67acbab87911d
Patch
https://github.com/BlogoText/blogotext/issues/345
Issue Tracking
Third Party Advisory

Уязвимые конфигурации

Конфигурация 1

cpe:2.3:a:blogotext_project:blogotext:*:*:*:*:*:*:*:*

Версия до 3.7.6 (включая)

EPSS

Процентиль: 53%

0.00306

Низкий

6.1 Medium

CVSS3

4.3 Medium

CVSS2

Дефекты

CWE-79

Связанные уязвимости

GHSA-ch9q-h28j-4hqm