PT-2017-17100 · Atutorspaces · Atutor

Published 2017-03-05 · Updated 2017-03-08 · CVE-2017-6483

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions ATutor version 2.2.2

Description Multiple Cross-Site Scripting issues were discovered due to insufficient filtration of user-supplied data. An attacker could execute arbitrary HTML and script code in a browser in the context of the vulnerable website. The issue is related to the lang code variable in the language edit.tmpl.php file.

Recommendations For ATutor version 2.2.2, ensure proper filtration of user-supplied data, especially for the lang code variable in the language edit.tmpl.php file, to prevent arbitrary HTML and script code execution. As a temporary workaround, consider restricting access to the language edit.tmpl.php page until a proper fix is applied.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2017-6483

Affected Products

Atutor

References · 5

• 🔥 https://github.com/atutor/ATutor/issues/129 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2017-6483 · Security Note
• https://osv.dev/vulnerability/CVE-2017-6483 · Vendor Advisory
• http://securityfocus.com/bid/96578 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-6483 · Note