PT-2018-5259 · Quickapps · Quickappscms

Prodigysml · Published 2018-01-03 · Updated 2022-05-14 · CVE-2017-1000495

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions QuickApps CMS version 2.0.0

Description The issue allows for Stored Cross-site Scripting in the user's real name field, which can result in denial of service and enable unauthorized actions to be performed with an administrator user's account.

Recommendations For QuickApps CMS version 2.0.0, update to a version that fixes the Stored Cross-site Scripting issue in the user's real name field to prevent denial of service and unauthorized actions.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2017-1000495

GHSA-825G-F3G2-6VXF

Affected Products

Quickappscms

References · 6

• 🔥 https://github.com/quickapps/cms/issues/183 · Exploit
• https://osv.dev/vulnerability/CVE-2017-1000495 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-825g-f3g2-6vxf · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2017-1000495 · Security Note
• https://github.com/quickapps/cms · Note
• https://github.com/quickapps/cms/commit/7d648f21bd87af8263dcd6449f0946a2dd31348a · Note