PT-2023-10341 · Unknown · Mosbth Cimage

Mosbth · Publicado 2023-01-29 · Atualizado 2024-05-17 · CVE-2016-15022

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Média

Vetor base

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions mosbth cimage versions up to 0.7.18

Description A vulnerability was found in mosbth cimage, affecting an unknown functionality of the file check system.php. The manipulation of the argument $ SERVER['SERVER SOFTWARE'] leads to cross site scripting. The attack can be launched remotely. The complexity of an attack is rather high, and the exploitation appears to be difficult. Upgrading to version 0.7.19 is able to address this issue.

Recommendations To resolve the issue, upgrade to version 0.7.19. As a temporary workaround, consider restricting access to the check system.php file until the upgrade is applied. Additionally, be cautious when using the $ SERVER['SERVER SOFTWARE'] argument to minimize the risk of exploitation.

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2016-15022

GHSA-6HV3-9FQX-8PG5

Produtos afetados

Mosbth Cimage

Referências · 10

• https://github.com/mosbth/cimage/releases/tag/v0.7.19 · Correção
• https://github.com/mosbth/cimage · Nota
• https://github.com/mosbth/cimage/commit/401478c8393989836beeddfeac5ce44570af162b · Correção
• https://vuldb.com/?ctiid.219715 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2016-15022 · Nota de Segurança
• https://t.me/cibsecurity/57134 · Publicação no Telegram
• https://osv.dev/vulnerability/CVE-2016-15022 · Aviso do Fabricante
• https://vuldb.com/?id.219715 · Nota
• https://t.me/cvenotify/43036 · Publicação no Telegram
• https://osv.dev/vulnerability/GHSA-6hv3-9fqx-8pg5 · Aviso do Fabricante