PT-2017-16790 · Scientiamobile+1 · Wurfl-Dbapi+1

Published 2017-02-12 · Updated 2019-03-12 · CVE-2017-5962

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions contexts wurfl (for TYPO3) versions prior to 0.4.2

Description The issue is caused by insufficient filtration of user-supplied data in the force ua HTTP GET parameter passed to the "/contexts wurfl/Library/wurfl-dbapi-1.4.4.0/check wurfl.php" API endpoint. This allows an attacker to execute arbitrary HTML and script code in a browser in the context of the vulnerable website.

Recommendations For versions prior to 0.4.2, update to version 0.4.2 or later to resolve the issue. As a temporary workaround, consider restricting access to the "/contexts wurfl/Library/wurfl-dbapi-1.4.4.0/check wurfl.php" API endpoint to minimize the risk of exploitation. Avoid using the force ua parameter in the affected API endpoint until the issue is resolved.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2017-5962

Affected Products

Contexts Wurfl

Wurfl-Dbapi

References · 4

• https://osv.dev/vulnerability/CVE-2017-5962 · Vendor Advisory
• https://forge.typo3.org/issues/79326 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2017-5962 · Security Note
• http://securityfocus.com/bid/96158 · Note