PT-2019-14768 · Xoops · Xoops

Published 2019-09-30 · Updated 2019-10-04 · CVE-2019-16684

Positive Technologies (AI Summary)

CVSS v3.1

4.8

Medium

Base vector

AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Xoops version 2.5.10

Description An issue was discovered in the image-manager. When any image with a JavaScript payload as its name is hovered over in the list or in the Edit page, the payload executes.

Recommendations For Xoops version 2.5.10, consider disabling the image-manager functionality until a patch is available to prevent potential exploitation. Restrict access to the image-manager module to minimize the risk of payload execution. Avoid hovering over suspicious images in the list or Edit page until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2019-16684

Affected Products

Xoops

References · 5

• 🔥 https://blog.nirajkhatiwada.com.np/cve-2019-16684-stored-cross-site-scripting · Exploit
• https://github.com/XOOPS/XoopsCore25/commits/master · Patch
• https://osv.dev/vulnerability/CVE-2019-16684 · Vendor Advisory
• https://xoops.org/modules/publisher · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-16684 · Security Note