PT-2017-10921 · Relevanssi · Relevanssi Premium

Mallory Adams + 1 · Published 2017-11-17 · Updated 2017-12-01 · CVE-2017-1000225

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Relevanssi Premium version 1.14.8

Description The issue is related to a Reflected XSS in Relevanssi Premium. This could allow an unauthenticated attacker to perform actions similar to those of an admin when the relevanssi didyoumean() function is used.

Recommendations For Relevanssi Premium version 1.14.8, consider disabling the relevanssi didyoumean() function until a patch is available to prevent potential exploitation.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2017-1000225

Affected Products

Relevanssi Premium

References · 3

• 🔥 https://security.dxw.com/advisories/reflected-xss-in-relevanssi-premium-when-using-relevanssi_didyoumean-could-allow-unauthenticated-attacker-to-do-almost-anything-an-admin-can · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2017-1000225 · Security Note
• https://osv.dev/vulnerability/CVE-2017-1000225 · Vendor Advisory