CVE-2019-11398

Опубликовано: 08 мая 2019

Источник: nvd

CVSS3: 6.1

CVSS2: 4.3

EPSS Низкий

Описание

Multiple cross-site scripting (XSS) vulnerabilities in UliCMS 2019.2 and 2019.1 allow remote attackers to inject arbitrary web script or HTML via the go parameter to admin/index.php, the go parameter to /admin/index.php?register=register, or the error parameter to admin/index.php?action=favicon.

Ссылки

http://packetstormsecurity.com/files/153219/UliCMS-2019.1-Cross-Site-Scripting.html
https://en.ulicms.de/
Vendor Advisory
https://www.exploit-db.com/exploits/46741/
Exploit
Third Party Advisory
VDB Entry
http://packetstormsecurity.com/files/153219/UliCMS-2019.1-Cross-Site-Scripting.html
https://en.ulicms.de/
Vendor Advisory
https://www.exploit-db.com/exploits/46741/
Exploit
Third Party Advisory
VDB Entry

Уязвимые конфигурации

Конфигурация 1

Одно из

cpe:2.3:a:ulicms:ulicms:2019.1:*:*:*:*:*:*:*

cpe:2.3:a:ulicms:ulicms:2019.2:*:*:*:*:*:*:*

EPSS

Процентиль: 84%

0.02167

Низкий

6.1 Medium

CVSS3

4.3 Medium

CVSS2

Дефекты

CWE-79

Связанные уязвимости

GHSA-87xm-cmrv-fg46