PT-2017-17615 · Cmsms · Cms Made Simple

CVE-2017-7256 · Publicado 2017-03-24 · Atualizado 2024-02-14

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Média

Vetor base

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions CMS Made Simple (CMSMS) version 2.1.6

Description A security issue exists in the "Content-->News-->Add Article" feature of the software, where an attacker can exploit the m1 summary parameter to conduct a cross-site scripting (XSS) attack. This attack requires the attacker to be logged in to the system.

Recommendations For CMS Made Simple (CMSMS) version 2.1.6, avoid using the m1 summary parameter in the "Content-->News-->Add Article" feature until a fix is available. As a temporary workaround, consider restricting access to this feature to minimize the risk of exploitation.

Exploit

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2017-7256

Produtos afetados

Cms Made Simple

Referências · 4

• 🔥 http://03i0.com/index.php/archives/113 · Exploit
• https://osv.dev/vulnerability/CVE-2017-7256 · Aviso do Fabricante
• http://securityfocus.com/bid/97204 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2017-7256 · Nota de Segurança