PT-2017-14501 · Mediabox · Tinywebgallery

Publicado 2017-11-06 · Atualizado 2017-11-29 · CVE-2017-16635

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Média

Vetor base

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions TinyWebGallery version 2.4

Description The issue allows remote attackers with low-privilege user accounts for backend access to inject malicious script codes into the TWG Explorer item listing. This is achieved by exploiting the mkname, mkitem, and item parameters of the Add/Create module. The request method to inject is POST, and the attack vector is located on the application-side of the service. The injection point is the add/create input field, and the execution point occurs in the item listing after the add or create.

Recommendations For TinyWebGallery version 2.4, consider restricting access to the Add/Create module to prevent exploitation, and avoid using the mkname, mkitem, and item parameters until a fix is available. As a temporary workaround, consider validating and sanitizing user input in the add/create input field to minimize the risk of malicious script code injection.

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2017-16635

Produtos afetados

Tinywebgallery

Referências · 3

• https://osv.dev/vulnerability/CVE-2017-16635 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2017-16635 · Nota de Segurança
• https://vulnerability-lab.com/get_content.php?id=1997 · Nota