exploitDog

CVE-2017-9448

Опубликовано: 06 июн. 2017

Источник: nvd

CVSS3: 5.4

CVSS2: 3.5

EPSS Низкий

Описание

Cross-site scripting (XSS) vulnerabilities in BigTree CMS through 4.2.18 allow remote authenticated users to inject arbitrary web script or HTML via the description parameter. This issue exists in core\admin\ajax\pages\save-revision.php and core\admin\modules\pages\revisions.php. Low-privileged (administrator) users can attack high-privileged (Developer) users.

Ссылки

https://github.com/bigtreecms/BigTree-CMS/issues/294
Issue Tracking
Patch
Third Party Advisory
https://github.com/bigtreecms/BigTree-CMS/issues/294
Issue Tracking
Patch
Third Party Advisory

Уязвимые конфигурации

Конфигурация 1

cpe:2.3:a:bigtreecms:bigtree_cms:*:*:*:*:*:*:*:*

Версия до 4.2.18 (включая)

EPSS

Процентиль: 35%

0.0014

Низкий

5.4 Medium

CVSS3

3.5 Low

CVSS2

Дефекты

CWE-79

Связанные уязвимости

GHSA-p6ch-mwq9-3g2q

CVSS3: 5.4

github

больше 3 лет назад

Cross-site scripting (XSS) vulnerabilities in BigTree CMS through 4.2.18 allow remote authenticated users to inject arbitrary web script or HTML via the description parameter. This issue exists in core\admin\ajax\pages\save-revision.php and core\admin\modules\pages\revisions.php. Low-privileged (administrator) users can attack high-privileged (Developer) users.

EPSS

Процентиль: 35%

0.0014

Низкий

5.4 Medium

CVSS3

3.5 Low

CVSS2

Дефекты

CWE-79