PT-2017-18608 · Invision Power Services · Invision Power Services Community Suite

Publicado 2017-05-11 · Atualizado 2020-06-03 · CVE-2017-8898

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Invision Power Services (IPS) Community Suite versions 4.1.19.2 and earlier

Description The issue concerns stored XSS in the Announcements feature, which can lead to privilege escalation from a moderator to an admin. This is achieved by exploiting the announce content parameter in an "index.php?/modcp/announcements/&action=create" request, related to the "<> Source" option.

Recommendations For versions 4.1.19.2 and earlier, as a temporary workaround, consider restricting access to the Announcements feature, specifically the "<> Source" option, until a fix is available. Avoid using the announce content parameter in the affected request until the issue is resolved.

Exploit

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2017-8898

Produtos afetados

Invision Power Services Community Suite

Referências · 5

• 🔥 https://twitter.com/sxcurity/status/862284967715381248 · Exploit
• 🔥 https://twitter.com/insecurity/status/862154908895780864 · Exploit
• 🔥 http://zeroday.insecurity.zone/exploits/ipb_owned.txt · Exploit
• https://osv.dev/vulnerability/CVE-2017-8898 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2017-8898 · Nota de Segurança