PT-2017-13910 · Shaarli · Shaarli

Chb9 · Publicado 2017-10-10 · Atualizado 2017-10-27 · CVE-2017-15215

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Média

Vetor base

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Shaarli version 0.9.1

Description The issue allows an unauthenticated attacker to inject JavaScript via the searchtags parameter to "index.php". If the victim is an administrator, an attacker can take over the admin session, change global settings, or add/delete links. It is also possible to execute JavaScript against unauthenticated users.

Recommendations For Shaarli version 0.9.1, consider restricting access to the "index.php" endpoint or avoiding the use of the searchtags parameter until a fix is available. As a temporary workaround, restrict the ability to inject JavaScript code to minimize the risk of exploitation.

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2017-15215

Produtos afetados

Shaarli

Referências · 5

• https://github.com/shaarli/Shaarli/pull/987 · Nota
• https://github.com/shaarli/Shaarli/releases/tag/v0.9.2 · Nota
• http://openwall.com/lists/oss-security/2017/10/07/2 · Correção
• https://osv.dev/vulnerability/CVE-2017-15215 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2017-15215 · Nota de Segurança