PT-2017-6782 · Clipbucket · Clipbucket

Deependra Bapna · Published 2017-04-06 · Updated 2017-04-12 · CVE-2015-4673

Positive Technologies (AI Summary)

CVSS v2.0

3.5

Low

Base vector

AV:N/AC:M/Au:S/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions ClipBucket version 2.7.0.5

Description The issue concerns multiple cross-site scripting (XSS) vulnerabilities. These vulnerabilities allow remote authenticated users to inject arbitrary web script or HTML. The injection can occur via specific parameters in certain PHP files, including the collection description parameter to "upload/manage collections.php" in an add new action, and the photo description, photo tags, or photo title parameters to "upload/actions/photo uploader.php".

Recommendations For ClipBucket version 2.7.0.5, consider restricting access to the upload/manage collections.php and upload/actions/photo uploader.php files until a patch is available. As a temporary workaround, avoid using the collection description, photo description, photo tags, and photo title parameters in the affected API endpoints until the issue is resolved.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2015-4673

Affected Products

Clipbucket

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2015-4673 · Security Note
• http://secpod.org/advisories/SecPod_ClipBucket_Multiple_XSS_Vuln.txt · Note
• http://secpod.com/blog/clipbucket-2-7-0-5-multiple-stored-cross-site-scripting-vulnerability · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-4673 · Note
• http://secpod.org/advisories_cvrf/SecPod_ClipBucket_Multiple_XSS_Vuln.xml · Note