PT-2017-6782 · Clipbucket · Clipbucket

Deependra Bapna · Publicado 2017-04-06 · Atualizado 2017-04-12 · CVE-2015-4673

Positive Technologies (AI Summary)

CVSS v2.0

3.5

Baixa

Vetor base

AV:N/AC:M/Au:S/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions ClipBucket version 2.7.0.5

Description The issue concerns multiple cross-site scripting (XSS) vulnerabilities. These vulnerabilities allow remote authenticated users to inject arbitrary web script or HTML. The injection can occur via specific parameters in certain PHP files, including the collection description parameter to "upload/manage collections.php" in an add new action, and the photo description, photo tags, or photo title parameters to "upload/actions/photo uploader.php".

Recommendations For ClipBucket version 2.7.0.5, consider restricting access to the upload/manage collections.php and upload/actions/photo uploader.php files until a patch is available. As a temporary workaround, avoid using the collection description, photo description, photo tags, and photo title parameters in the affected API endpoints until the issue is resolved.

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2015-4673

Produtos afetados

Clipbucket

Referências · 5

• http://secpod.org/advisories/SecPod_ClipBucket_Multiple_XSS_Vuln.txt · Nota
• http://secpod.com/blog/clipbucket-2-7-0-5-multiple-stored-cross-site-scripting-vulnerability · Nota
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-4673 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2015-4673 · Nota de Segurança
• http://secpod.org/advisories_cvrf/SecPod_ClipBucket_Multiple_XSS_Vuln.xml · Nota