PT-2017-7908 · Kohana · Kohana
David Sopas
·
Publicado
2017-08-31
·
Atualizado
2021-03-31
·
CVE-2016-10510
CVSS v3.1
6.1
Média
| Vetor | AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N |
Name of the Vulnerable Software and Affected Versions
Kohana versions prior to 3.3.6
Description
A cross-site scripting (XSS) issue exists in the Security component, allowing remote attackers to inject arbitrary web script or HTML by bypassing the
strip image tags protection mechanism in system/classes/Kohana/Security.php. This could potentially affect a significant number of devices, although the exact number is not specified.Recommendations
For versions prior to 3.3.6, update to version 3.3.6 or later to resolve the issue. As a temporary workaround, consider disabling the
strip image tags function in system/classes/Kohana/Security.php until a patch is available. Restrict access to the Security component to minimize the risk of exploitation. Avoid using the system/classes/Kohana/Security.php file in sensitive operations until the issue is resolved.Exploit
Correção
XSS
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Kohana