PT-2017-18307 · Pixel & Tonic · Craft Cms

Published 2017-05-01 · Updated 2022-05-17 · CVE-2017-8384

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Craft CMS versions prior to 2.6.2976

Description The issue allows for XSS attacks due to an array returned by HttpRequestService::getSegments() and getActionSegments() not being zero-based, resulting from an incomplete fix for a previous security issue.

Recommendations For versions prior to 2.6.2976, update to version 2.6.2976 or later to resolve the issue.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2017-8384

GHSA-9MCW-MWXV-GRWJ

Affected Products

Craft Cms

References · 6

• https://osv.dev/vulnerability/GHSA-9mcw-mwxv-grwj · Vendor Advisory
• https://twitter.com/CraftCMS/status/857743080224473088 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2017-8384 · Security Note
• https://osv.dev/vulnerability/CVE-2017-8384 · Vendor Advisory
• https://craftcms.com/changelog#2-6-2976 · Vendor Advisory
• https://github.com/craftcms/cms · Note