PT-2018-5259 · Quickapps · Quickappscms

Prodigysml · Publicado 2018-01-03 · Atualizado 2022-05-14 · CVE-2017-1000495

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Média

Vetor base

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions QuickApps CMS version 2.0.0

Description The issue allows for Stored Cross-site Scripting in the user's real name field, which can result in denial of service and enable unauthorized actions to be performed with an administrator user's account.

Recommendations For QuickApps CMS version 2.0.0, update to a version that fixes the Stored Cross-site Scripting issue in the user's real name field to prevent denial of service and unauthorized actions.

Exploit

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2017-1000495

GHSA-825G-F3G2-6VXF

Produtos afetados

Quickappscms

Referências · 6

• 🔥 https://github.com/quickapps/cms/issues/183 · Exploit
• https://github.com/quickapps/cms · Nota
• https://github.com/quickapps/cms/commit/7d648f21bd87af8263dcd6449f0946a2dd31348a · Nota
• https://osv.dev/vulnerability/CVE-2017-1000495 · Aviso do Fabricante
• https://osv.dev/vulnerability/GHSA-825g-f3g2-6vxf · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2017-1000495 · Nota de Segurança