PT-2012-2991 · Impresscms · Impresscms

Published 2012-10-06 · Updated 2017-08-29 · CVE-2012-0986

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions ImpressCMS versions 1.2.x through 1.2.7 Final ImpressCMS versions 1.3.x through 1.3.1 Final

Description The issue allows remote attackers to inject arbitrary web script or HTML via the PATH INFO to specific API endpoints, including "notifications.php", "modules/system/admin/images/browser.php", and "modules/content/admin/content.php".

Recommendations For ImpressCMS versions 1.2.x through 1.2.7 Final, update to version 1.2.7 Final or later. For ImpressCMS versions 1.3.x through 1.3.1 Final, update to version 1.3.1 Final or later.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2012-0986

Affected Products

Impresscms

References · 11

• 🔥 http://archives.neohapsis.com/archives/bugtraq/2012-01/0022.html · Exploit
• 🔥 http://osvdb.org/78141 · Exploit
• 🔥 http://osvdb.org/78142 · Exploit
• 🔥 https://htbridge.com/advisory/HTB23064 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2012-0986 · Security Note
• http://community.impresscms.org/modules/smartsection/item.php?itemid=579 · Vendor Advisory
• http://secunia.com/advisories/47448 · Vendor Advisory
• https://exchange.xforce.ibmcloud.com/vulnerabilities/72145 · Note
• http://securityfocus.com/bid/51268 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-0986 · Note
• http://osvdb.org/78140 · Note