PT-2019-7915 · Metinfo · Metinfo

Publicado 2019-05-09 · Atualizado 2019-05-09 · CVE-2017-12788

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Média

Vetor base

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Metinfo version 5.3.18

Description The issue concerns multiple cross-site scripting (XSS) vulnerabilities. These vulnerabilities allow remote attackers to inject arbitrary web script or HTML. The injection can occur via the class1 parameter or the anyid parameter in the admin/index.php file.

Recommendations For Metinfo version 5.3.18, update to a newer version that contains a fix for this issue. As a temporary workaround, consider restricting access to the admin/index.php file to minimize the risk of exploitation. Avoid using the class1 and anyid parameters in the affected file until the issue is resolved.

Exploit

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2017-12788

Produtos afetados

Metinfo

Referências · 3

• 🔥 https://github.com/lemon666/vuln/blob/master/MetInfo5.3.md · Exploit
• https://osv.dev/vulnerability/CVE-2017-12788 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2017-12788 · Nota de Segurança