CVE-2017-18217

Опубликовано: 05 мар. 2018

Источник: nvd

CVSS3: 6.1

CVSS2: 4.3

EPSS Низкий

Описание

An issue was discovered in InvoicePlane before 1.5.5. It was observed that the Email address and Web address parameters are vulnerable to Cross Site Scripting, related to application/modules/clients/views/view.php, application/modules/invoices/views/view.php, and application/modules/quotes/views/view.php.

Ссылки

http://blog.isecurion.com/2018/04/23/invoice-plane-v1-5-cross-site-scripting-vulnerability/
Exploit
Third Party Advisory
https://github.com/InvoicePlane/InvoicePlane/pull/542
Patch
Third Party Advisory
https://github.com/InvoicePlane/InvoicePlane/pull/551
Patch
Third Party Advisory
http://blog.isecurion.com/2018/04/23/invoice-plane-v1-5-cross-site-scripting-vulnerability/
Exploit
Third Party Advisory
https://github.com/InvoicePlane/InvoicePlane/pull/542
Patch
Third Party Advisory
https://github.com/InvoicePlane/InvoicePlane/pull/551
Patch
Third Party Advisory

Уязвимые конфигурации

Конфигурация 1

cpe:2.3:a:invoiceplane:invoiceplane:*:*:*:*:*:*:*:*

Версия до 1.5.5 (исключая)

EPSS

Процентиль: 56%

0.0034

Низкий

6.1 Medium

CVSS3

4.3 Medium

CVSS2

Дефекты

CWE-79

Связанные уязвимости

GHSA-vhw5-93mq-qwww