PT-2016-3897 · Symphony · Symphony Cms

Sachin Wagh + 1 · Published 2016-01-08 · Updated 2020-08-25 · CVE-2015-8376

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Symphony CMS version 2.6.3

Description The issue concerns multiple cross-site scripting (XSS) vulnerabilities. These vulnerabilities allow remote attackers to inject arbitrary web script or HTML. The vulnerable parameters include the Name, Navigation Group, and Label parameters to the "blueprints/sections/edit/1" endpoint.

Recommendations For Symphony CMS version 2.6.3, update to a version that includes a fix for this issue. As a temporary workaround, consider restricting input for the Name, Navigation Group, and Label parameters to prevent arbitrary web script or HTML injection until a patch is available.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2015-8376

Affected Products

Symphony Cms

References · 3

• 🔥 http://seclists.org/fulldisclosure/2015/Dec/7 · Exploit
• 🔥 http://seclists.org/fulldisclosure/2015/Dec/101 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2015-8376 · Security Note