PT-2022-8065 · Unknown · Farcry Solr Pro Plugin

Williada-Lbcc · Published 2022-12-28 · Updated 2024-05-17 · CVE-2018-25055

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions FarCry Solr Pro Plugin versions up to 1.5.x

Description A vulnerability was found in the FarCry Solr Pro Plugin, affecting an unknown functionality of the file packages/forms/solrProSearch.cfc of the component Search Handler. The manipulation of the suggestion argument leads to cross-site scripting. The attack can be launched remotely. Upgrading to version 1.6.0 is able to address this issue.

Recommendations For FarCry Solr Pro Plugin versions up to 1.5.x, upgrade to version 1.6.0 to address the issue. As a temporary workaround, consider restricting the use of the suggestion argument in the affected Search Handler component until the upgrade is applied.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2018-25055

Affected Products

Farcry Solr Pro Plugin

References · 8

• 🔥 https://github.com/jeffcoughlin/farcrysolrpro/issues/78 · Exploit
• https://github.com/jeffcoughlin/farcrysolrpro/commit/b8f3d61511c9b02b781ec442bfb803cbff8e08d5 · Patch
• https://github.com/jeffcoughlin/farcrysolrpro/releases/tag/1.6.0 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2018-25055 · Security Note
• https://osv.dev/vulnerability/CVE-2018-25055 · Vendor Advisory
• https://vuldb.com/?ctiid.216961 · Note
• https://t.me/cvenotify/40888 · Telegram Post
• https://vuldb.com/?id.216961 · Note