PT-2018-6283 · Websitebaker · Websitebaker

Published 2018-01-10 · Updated 2018-02-01 · CVE-2017-16514

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions: WebsiteBaker version 2.10.0

Description: The issue concerns multiple persistent stored Cross-Site-Scripting (XSS) vulnerabilities. These vulnerabilities are located in the files /wb/admin/admintools/tool.php, related to the Droplet Description, and /install/index.php, related to the Site Title. They allow attackers to insert persistent JavaScript code that gets reflected back to users in multiple areas of the application.

Recommendations: For WebsiteBaker version 2.10.0, as a temporary workaround, consider restricting access to the files /wb/admin/admintools/tool.php and /install/index.php to minimize the risk of exploitation. Avoid using the Droplet Description and Site Title fields in the affected areas until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2017-16514

Affected Products

Websitebaker

References · 3

• https://osv.dev/vulnerability/CVE-2017-16514 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2017-16514 · Security Note
• https://gist.github.com/anonymous/13df19c04c7e86c0f5256b91376d593a · Note