PT-2017-10921 · Relevanssi · Relevanssi Premium

Mallory Adams + 1 · Publicado 2017-11-17 · Atualizado 2017-12-01 · CVE-2017-1000225

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Média

Vetor base

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Relevanssi Premium version 1.14.8

Description The issue is related to a Reflected XSS in Relevanssi Premium. This could allow an unauthenticated attacker to perform actions similar to those of an admin when the relevanssi didyoumean() function is used.

Recommendations For Relevanssi Premium version 1.14.8, consider disabling the relevanssi didyoumean() function until a patch is available to prevent potential exploitation.

Exploit

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2017-1000225

Produtos afetados

Relevanssi Premium

Referências · 3

• 🔥 https://security.dxw.com/advisories/reflected-xss-in-relevanssi-premium-when-using-relevanssi_didyoumean-could-allow-unauthenticated-attacker-to-do-almost-anything-an-admin-can · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2017-1000225 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2017-1000225 · Aviso do Fabricante