PT-2019-9541 · Layerbb · Layerbb

0Xb9 · Published 2019-03-17 · Updated 2019-03-22 · CVE-2018-17997

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions LayerBB version 1.1.1

Description The issue allows for XSS via the titles of conversations, specifically private messages (PMs).

Recommendations For LayerBB version 1.1.1, consider restricting the ability to set conversation titles until a fix is available. As a temporary workaround, avoid using potentially malicious titles in conversations to minimize the risk of exploitation.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2018-17997

Affected Products

Layerbb

References · 5

• 🔥 https://exploit-db.com/exploits/46079 · Exploit
• 🔥 http://packetstormsecurity.com/files/151015/LayerBB-1.1.1-Cross-Site-Scripting.html · Exploit
• https://github.com/AndyRixon/LayerBB/commits/master · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2018-17997 · Security Note
• https://osv.dev/vulnerability/CVE-2018-17997 · Vendor Advisory