CVE-2018-7465

Опубликовано: 26 апр. 2018

Источник: nvd

CVSS3: 5.4

CVSS2: 3.5

EPSS Низкий

Описание

An XSS issue was discovered in VirtueMart before 3.2.14. All the textareas in the backend of the plugin can be closed by simply adding to the value and saving the product/config. By editing back the product/config, the editor's browser will execute everything after the , leading to a possible XSS.

Ссылки

http://virtuemart.net/news/489-virtuemart-3-2-14-security-release-and-enhanced-invoice-handling
Vendor Advisory
https://imgur.com/a/Hf6JD
Exploit
Third Party Advisory
https://www.exploit-db.com/exploits/44625/
Exploit
Third Party Advisory
VDB Entry
http://virtuemart.net/news/489-virtuemart-3-2-14-security-release-and-enhanced-invoice-handling
Vendor Advisory
https://imgur.com/a/Hf6JD
Exploit
Third Party Advisory
https://www.exploit-db.com/exploits/44625/
Exploit
Third Party Advisory
VDB Entry

Уязвимые конфигурации

Конфигурация 1

cpe:2.3:a:virtuemart:virtuemart:*:*:*:*:*:joomla\!:*:*

Версия до 3.2.14 (исключая)

EPSS

Процентиль: 51%

0.00278

Низкий

5.4 Medium

CVSS3

3.5 Low

CVSS2

Дефекты

CWE-79

Связанные уязвимости

GHSA-8j7p-2f86-r4gv