PT-2019-9391 · Zrlog · Zrlog

1F3Lse · Publicado 2019-06-19 · Atualizado 2019-06-20 · CVE-2018-17079

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Média

Vetor base

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions ZRLOG version 2.0.1

Description A Stored XSS issue was found in the nickname field of the comment area, allowing for potential malicious script execution.

Recommendations For ZRLOG version 2.0.1, consider disabling the comment area or restricting user input in the nickname field until a fix is available.

Exploit

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2018-17079

Produtos afetados

Zrlog

Referências · 4

• 🔥 https://github.com/94fzb/zrlog/issues/38 · Exploit
• https://owasp.org/index.php/Cross-site_Scripting_%28XSS%29 · Nota
• https://osv.dev/vulnerability/CVE-2018-17079 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2018-17079 · Nota de Segurança