PT-2017-11445 · Simplerisk · Simplerisk

Published 2017-07-24 · Updated 2017-08-10 · CVE-2017-10711

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions SimpleRisk version 20170614-001

Description A CSRF attack on the 'reset.php' endpoint, specifically the Send Password Reset Email form, can insert XSS sequences via the user parameter.

Recommendations For version 20170614-001, consider disabling the Send Password Reset Email form temporarily until a patch is available to prevent CSRF attacks that could lead to XSS sequence insertion. Restrict access to the 'reset.php' endpoint to minimize the risk of exploitation. Avoid using the user parameter in the affected form until the issue is resolved.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2017-10711

Affected Products

Simplerisk

References · 4

• 🔥 https://youtube.com/watch?v=jOUKEYW0RQw · Exploit
• 🔥 https://seekurity.com/blog/general/reflected-xss-vulnerability-in-simplerisk · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2017-10711 · Security Note
• https://osv.dev/vulnerability/CVE-2017-10711 · Vendor Advisory