PT-2016-3897 · Symphony · Symphony Cms

Sachin Wagh + 1 · Publicado 2016-01-08 · Atualizado 2020-08-25 · CVE-2015-8376

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Média

Vetor base

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Symphony CMS version 2.6.3

Description The issue concerns multiple cross-site scripting (XSS) vulnerabilities. These vulnerabilities allow remote attackers to inject arbitrary web script or HTML. The vulnerable parameters include the Name, Navigation Group, and Label parameters to the "blueprints/sections/edit/1" endpoint.

Recommendations For Symphony CMS version 2.6.3, update to a version that includes a fix for this issue. As a temporary workaround, consider restricting input for the Name, Navigation Group, and Label parameters to prevent arbitrary web script or HTML injection until a patch is available.

Exploit

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2015-8376

Produtos afetados

Symphony Cms

Referências · 3

• 🔥 http://seclists.org/fulldisclosure/2015/Dec/7 · Exploit
• 🔥 http://seclists.org/fulldisclosure/2015/Dec/101 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2015-8376 · Nota de Segurança