CVE-2019-17522

Опубликовано: 12 окт. 2019

Источник: nvd

CVSS3: 4.8

CVSS2: 3.5

EPSS Низкий

Описание

A stored XSS vulnerability was discovered in Hotaru CMS v1.7.2 via the admin_index.php?page=settings SITE NAME field (aka SITE_NAME), a related issue to CVE-2011-4709.1.

Ссылки

https://github.com/HotaruCMS/HotaruCMS/blob/1a58334da94511df723bfbe78bba77765df181b1/install/libs/install_tables.php#L383
Exploit
Third Party Advisory
https://github.com/HotaruCMS/HotaruCMS/issues/101
Exploit
Third Party Advisory
https://github.com/HotaruCMS/HotaruCMS/blob/1a58334da94511df723bfbe78bba77765df181b1/install/libs/install_tables.php#L383
Exploit
Third Party Advisory
https://github.com/HotaruCMS/HotaruCMS/issues/101
Exploit
Third Party Advisory

Уязвимые конфигурации

Конфигурация 1

cpe:2.3:a:hotarucms:hotarucms:1.7.2:*:*:*:*:*:*:*

EPSS

Процентиль: 55%

0.00321

Низкий

4.8 Medium

CVSS3

3.5 Low

CVSS2

Дефекты

CWE-79

Связанные уязвимости

GHSA-72jh-xr22-cgrg