PT-2019-14768 · Xoops · Xoops

Publicado 2019-09-30 · Atualizado 2019-10-04 · CVE-2019-16684

Positive Technologies (AI Summary)

CVSS v3.1

4.8

Média

Vetor base

AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Xoops version 2.5.10

Description An issue was discovered in the image-manager. When any image with a JavaScript payload as its name is hovered over in the list or in the Edit page, the payload executes.

Recommendations For Xoops version 2.5.10, consider disabling the image-manager functionality until a patch is available to prevent potential exploitation. Restrict access to the image-manager module to minimize the risk of payload execution. Avoid hovering over suspicious images in the list or Edit page until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2019-16684

Produtos afetados

Xoops

Referências · 5

• 🔥 https://blog.nirajkhatiwada.com.np/cve-2019-16684-stored-cross-site-scripting · Exploit
• https://github.com/XOOPS/XoopsCore25/commits/master · Correção
• https://osv.dev/vulnerability/CVE-2019-16684 · Aviso do Fabricante
• https://xoops.org/modules/publisher · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2019-16684 · Nota de Segurança