CVE-2017-7998

Опубликовано: 08 янв. 2018

Источник: nvd

CVSS3: 6.1

CVSS2: 4.3

EPSS Низкий

Описание

Multiple cross-site scripting (XSS) vulnerabilities in Gespage before 7.4.9 allow remote attackers to inject arbitrary web script or HTML via the (1) printer name when adding a printer in the admin panel or (2) username parameter to webapp/users/user_reg.jsp.

Ссылки

http://seclists.org/fulldisclosure/2018/Jan/13
Mailing List
Third Party Advisory
https://sysdream.com/news/lab/2018-01-02-cve-2017-7998-gespage-stored-cross-site-scripting-xss-vulnerability/
Exploit
Third Party Advisory
http://seclists.org/fulldisclosure/2018/Jan/13
Mailing List
Third Party Advisory
https://sysdream.com/news/lab/2018-01-02-cve-2017-7998-gespage-stored-cross-site-scripting-xss-vulnerability/
Exploit
Third Party Advisory

Уязвимые конфигурации

Конфигурация 1

cpe:2.3:a:gespage:gespage:*:*:*:*:*:*:*:*

Версия до 7.4.9 (исключая)

EPSS

Процентиль: 85%

0.02398

Низкий

6.1 Medium

CVSS3

4.3 Medium

CVSS2

Дефекты

CWE-79

Связанные уязвимости

GHSA-vfpm-4738-jrxf