PT-2012-3708 · Syndeo · Syndeocms

Ivano Binetti · Publicado 2012-04-17 · Atualizado 2017-08-29 · CVE-2012-1979

Positive Technologies (AI Summary)

CVSS v2.0

3.5

Baixa

Vetor base

AV:N/AC:M/Au:S/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions SyndeoCMS versions 3.0.01 and earlier

Description The issue is related to a cross-site scripting (XSS) vulnerability. It allows remote authenticated users to inject arbitrary web script or HTML via the email parameter in an edit user configuration action.

Recommendations For SyndeoCMS versions 3.0.01 and earlier, consider restricting access to the edit user configuration action until a patch is available. As a temporary workaround, avoid using the email parameter in the affected configuration action to minimize the risk of exploitation.

Exploit

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2012-1979

Produtos afetados

Syndeocms

Referências · 9

• 🔥 http://exploit-db.com/exploits/18686 · Exploit
• 🔥 https://exploit-db.com/exploits/18686 · Exploit
• 🔥 http://webapp-security.com/wp-content/uploads/2012/03/syndeocms_3.0.01-Persistent-XSS.txt · Exploit
• http://securityfocus.com/bid/52840 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2012-1979 · Nota de Segurança
• http://packetstormsecurity.org/files/111405/SyndeoCMS-3.0.01-Cross-Site-Scripting.html · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/74545 · Nota
• http://osvdb.org/80746 · Nota
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-1979 · Nota