PT-2017-7465 · Exponent · Exponent Cms

Sachin Wagh + 1 · Publicado 2017-01-18 · Atualizado 2017-01-19 · CVE-2015-8684

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Média

Vetor base

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Exponent CMS versions prior to 2.3.7

Description The issue allows remote attackers to conduct cross-site scripting (XSS) attacks and possibly have other unspecified impact by uploading files with certain extensions, such as .html, and then accessing them via the elFinder functionality.

Recommendations For versions prior to 2.3.7, update to version 2.3.7 or later to resolve the issue. As a temporary workaround, consider restricting file uploads to only necessary file types and disabling access to the elFinder functionality until the update is applied.

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2015-8684

Produtos afetados

Exponent Cms

Referências · 4

• https://nvd.nist.gov/vuln/detail/CVE-2015-8684 · Nota de Segurança
• https://packetstormsecurity.com/files/136762/Exponent-CMS-2.3.5-File-Upload-Cross-Site-Scripting.html · Nota
• https://exponentcms.lighthouseapp.com/projects/61783/tickets/1323-exponent-cms-235-file-upload-cross-site-scripting-vulnerability · Aviso do Fabricante
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-8684 · Nota