PT-2017-7679 · Clipbucket · Clipbucket

Publicado 2017-04-06 · Atualizado 2017-04-12 · CVE-2016-1000307

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Média

Vetor base

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions ClipBucket version 2.8.1 and probably prior

Description The issue allows remote attackers to inject arbitrary web script or HTML via several parameters, including profile desc, about me, schools, occupation, companies, hobbies, fav movies, fav music, fav books to the ProfileSettings page, note parameter to the PersonalNotes Section, and closed msg, description, allowed types parameters to the WebsiteConfigurations Section.

Recommendations For ClipBucket version 2.8.1 and probably prior, update to a version that includes a fix for this issue, as no specific workaround is provided for these versions. As a temporary workaround, consider restricting access to the ProfileSettings page, PersonalNotes Section, and WebsiteConfigurations Section until a patch is available. Avoid using the parameters profile desc, about me, schools, occupation, companies, hobbies, fav movies, fav music, fav books, note, closed msg, description, allowed types in the affected sections until the issue is resolved.

Exploit

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2016-1000307

Produtos afetados

Clipbucket

Referências · 3

• 🔥❌ https://github.com/distributedweaknessfiling/DWF-Database-Artifacts/blob/master/DWF/2016/1000307/CVE-2016-1000307.json · Exploit, Deleted
• https://osv.dev/vulnerability/CVE-2016-1000307 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2016-1000307 · Nota de Segurança