PT-2017-16790 · Scientiamobile+1 · Wurfl-Dbapi+1

Publicado 2017-02-12 · Atualizado 2019-03-12 · CVE-2017-5962

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Média

Vetor base

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions contexts wurfl (for TYPO3) versions prior to 0.4.2

Description The issue is caused by insufficient filtration of user-supplied data in the force ua HTTP GET parameter passed to the "/contexts wurfl/Library/wurfl-dbapi-1.4.4.0/check wurfl.php" API endpoint. This allows an attacker to execute arbitrary HTML and script code in a browser in the context of the vulnerable website.

Recommendations For versions prior to 0.4.2, update to version 0.4.2 or later to resolve the issue. As a temporary workaround, consider restricting access to the "/contexts wurfl/Library/wurfl-dbapi-1.4.4.0/check wurfl.php" API endpoint to minimize the risk of exploitation. Avoid using the force ua parameter in the affected API endpoint until the issue is resolved.

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2017-5962

Produtos afetados

Contexts Wurfl

Wurfl-Dbapi

Referências · 4

• https://osv.dev/vulnerability/CVE-2017-5962 · Aviso do Fabricante
• https://forge.typo3.org/issues/79326 · Correção
• http://securityfocus.com/bid/96158 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2017-5962 · Nota de Segurança