PT-2017-18923 · Bigtree · Bigtree Cms

Xfkxfk · Publicado 2017-06-05 · Atualizado 2024-08-16 · CVE-2017-9441

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Média

Vetor base

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions BigTree CMS versions through 4.2.18

Description Multiple cross-site scripting (XSS) vulnerabilities allow remote authenticated users to inject arbitrary web script or HTML by uploading a crafted package. The issue is triggered by mishandling of the title, version, or author name parameter in manifest.json. This exists in coreadminmodulesdeveloperextensionsinstallunpack.php and coreadminmodulesdeveloperpackagesinstallunpack.php. The vendor notes that any installed package or extension must be implicitly trusted as they can write PHP files.

Recommendations For BigTree CMS versions through 4.2.18, consider disabling the package installation feature until a patch is available to prevent exploitation of the title, version, and author name parameters in manifest.json. Restrict access to the coreadminmodulesdeveloperextensionsinstallunpack.php and coreadminmodulesdeveloperpackagesinstallunpack.php files to minimize the risk of arbitrary web script or HTML injection. Avoid using the title, version, and author name parameters in the affected manifest.json files until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2017-9441

Produtos afetados

Bigtree Cms

Referências · 7

• https://github.com/bigtreecms/BigTree-CMS/issues/290 · Correção
• https://nvd.nist.gov/vuln/detail/CVE-2017-9441 · Nota de Segurança
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-9441 · Nota
• https://t.me/cvenotify/81983 · Publicação no Telegram
• https://t.me/cvenotify/89249 · Publicação no Telegram
• https://osv.dev/vulnerability/CVE-2017-9441 · Aviso do Fabricante
• https://t.me/cvenotify/90915 · Publicação no Telegram