PT-2017-18688 · Calendarxp · Calendarxp Flatcalendarxp+1

Published 2017-05-18 · Updated 2018-01-18 · CVE-2017-9072

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions CalendarXP FlatCalendarXP versions 9.9.290 and earlier CalendarXP PopCalendarXP versions 9.8.308 and earlier

Description The issue affects common parts of HTML files in CalendarXP products, specifically causing XSS in certain files. For CalendarXP FlatCalendarXP, the files iflateng.htm and nflateng.htm are affected. For CalendarXP PopCalendarXP, the files ipopeng.htm and npopeng.htm are vulnerable.

Recommendations For CalendarXP FlatCalendarXP versions 9.9.290 and earlier, consider restricting access to the iflateng.htm and nflateng.htm files until a fix is available. For CalendarXP PopCalendarXP versions 9.8.308 and earlier, restrict access to the ipopeng.htm and npopeng.htm files as a temporary mitigation measure.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2017-9072

Affected Products

Calendarxp Flatcalendarxp

Calendarxp Popcalendarxp

References · 5

• https://osv.dev/vulnerability/CVE-2017-9072 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2017-9072 · Security Note
• https://github.com/victorwon/calendarxp/issues/2 · Note
• http://securityfocus.com/bid/102632 · Note
• http://oracle.com/technetwork/security-advisory/cpujan2018-3236628.html · Note