PT-2018-5234 · Lavalite · Lavalite

Prodigysml · Published 2018-01-03 · Updated 2022-05-14 · CVE-2017-1000467

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions LavaLite version 5.2.4

Description The issue concerns a stored cross-site scripting vulnerability within the blog creation page. This can lead to disruption of service and allow the execution of javascript code.

Recommendations For LavaLite version 5.2.4, consider disabling the blog creation page until a patch is available to prevent potential exploitation.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2017-1000467

GHSA-H7VH-6GMM-G7H9

Affected Products

Lavalite

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2017-1000467 · Security Note
• https://osv.dev/vulnerability/CVE-2017-1000467 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-h7vh-6gmm-g7h9 · Vendor Advisory
• https://github.com/LavaLite/cms/issues/209 · Note