PT-2012-3708 · Syndeo · Syndeocms

Ivano Binetti · Published 2012-04-17 · Updated 2017-08-29 · CVE-2012-1979

Positive Technologies (AI Summary)

CVSS v2.0

3.5

Low

Base vector

AV:N/AC:M/Au:S/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions SyndeoCMS versions 3.0.01 and earlier

Description The issue is related to a cross-site scripting (XSS) vulnerability. It allows remote authenticated users to inject arbitrary web script or HTML via the email parameter in an edit user configuration action.

Recommendations For SyndeoCMS versions 3.0.01 and earlier, consider restricting access to the edit user configuration action until a patch is available. As a temporary workaround, avoid using the email parameter in the affected configuration action to minimize the risk of exploitation.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2012-1979

Affected Products

Syndeocms

References · 9

• 🔥 http://exploit-db.com/exploits/18686 · Exploit
• 🔥 https://exploit-db.com/exploits/18686 · Exploit
• 🔥 http://webapp-security.com/wp-content/uploads/2012/03/syndeocms_3.0.01-Persistent-XSS.txt · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2012-1979 · Security Note
• http://securityfocus.com/bid/52840 · Note
• http://packetstormsecurity.org/files/111405/SyndeoCMS-3.0.01-Cross-Site-Scripting.html · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/74545 · Note
• http://osvdb.org/80746 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-1979 · Note