PT-2018-6283 · Websitebaker · Websitebaker

Publicado 2018-01-10 · Atualizado 2018-02-01 · CVE-2017-16514

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Média

Vetor base

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions: WebsiteBaker version 2.10.0

Description: The issue concerns multiple persistent stored Cross-Site-Scripting (XSS) vulnerabilities. These vulnerabilities are located in the files /wb/admin/admintools/tool.php, related to the Droplet Description, and /install/index.php, related to the Site Title. They allow attackers to insert persistent JavaScript code that gets reflected back to users in multiple areas of the application.

Recommendations: For WebsiteBaker version 2.10.0, as a temporary workaround, consider restricting access to the files /wb/admin/admintools/tool.php and /install/index.php to minimize the risk of exploitation. Avoid using the Droplet Description and Site Title fields in the affected areas until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2017-16514

Produtos afetados

Websitebaker

Referências · 3

• https://gist.github.com/anonymous/13df19c04c7e86c0f5256b91376d593a · Nota
• https://osv.dev/vulnerability/CVE-2017-16514 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2017-16514 · Nota de Segurança