PT-2017-17100 · Atutorspaces · Atutor

Publicado 2017-03-05 · Atualizado 2017-03-08 · CVE-2017-6483

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Média

Vetor base

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions ATutor version 2.2.2

Description Multiple Cross-Site Scripting issues were discovered due to insufficient filtration of user-supplied data. An attacker could execute arbitrary HTML and script code in a browser in the context of the vulnerable website. The issue is related to the lang code variable in the language edit.tmpl.php file.

Recommendations For ATutor version 2.2.2, ensure proper filtration of user-supplied data, especially for the lang code variable in the language edit.tmpl.php file, to prevent arbitrary HTML and script code execution. As a temporary workaround, consider restricting access to the language edit.tmpl.php page until a proper fix is applied.

Exploit

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2017-6483

Produtos afetados

Atutor

Referências · 5

• 🔥 https://github.com/atutor/ATutor/issues/129 · Exploit
• http://securityfocus.com/bid/96578 · Nota
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-6483 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2017-6483 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2017-6483 · Aviso do Fabricante