PT-2023-10351 · Typo3 · Mback2K Mh Httpbl Extension

Nicole Cordes · Publicado 2023-06-01 · Atualizado 2024-08-06 · CVE-2016-15032

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Média

Vetor base

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions mback2k mh httpbl Extension versions 1.1.7 and earlier

Description A problematic vulnerability has been found in the mback2k mh httpbl Extension on TYPO3, affecting the function stopOutput of the file class.tx mhhttpbl.php. The manipulation of the argument $ SERVER['REMOTE ADDR'] leads to cross-site scripting. It is possible to initiate the attack remotely. This issue only affects products that are no longer supported by the maintainer.

Recommendations For versions 1.1.7 and earlier, upgrade to version 1.1.8 to address this issue. As a temporary workaround, consider restricting access to the stopOutput function of the class.tx mhhttpbl.php file until the upgrade is applied. Additionally, be cautious when using the $ SERVER['REMOTE ADDR'] argument to minimize the risk of exploitation.

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2016-15032

Produtos afetados

Mback2K Mh Httpbl Extension

Referências · 8

• https://github.com/mback2k/mh_httpbl/commit/a754bf306a433a8c18b55e25595593e8f19b9463 · Correção
• https://github.com/mback2k/mh_httpbl/releases/tag/mh_httpbl_1.1.8_security · Correção
• https://t.me/cvenotify/52057 · Publicação no Telegram
• https://nvd.nist.gov/vuln/detail/CVE-2016-15032 · Nota de Segurança
• https://vuldb.com/?id.230391 · Nota
• https://osv.dev/vulnerability/CVE-2016-15032 · Aviso do Fabricante
• https://t.me/cvenotify/89343 · Publicação no Telegram
• https://vuldb.com/?ctiid.230391 · Nota