PT-2023-10252 · Unknown · Tinymighty Wikiseo

21Tinymighty · Published 2023-02-06 · Updated 2024-05-17 · CVE-2015-10073

Positive Technologies (AI Summary)

CVSS v3.1

9.6

Critical

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions tinymighty WikiSEO version 1.2.1

Description A vulnerability was found in tinymighty WikiSEO, affecting the function modifyHTML of the file WikiSEO.body.php of the component Meta Property Tag Handler. The manipulation of the argument content leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.

Recommendations For tinymighty WikiSEO version 1.2.1, upgrade to version 1.2.2 to address this issue. As a temporary workaround, consider disabling the modifyHTML function until the patch is applied. Restrict access to the Meta Property Tag Handler component to minimize the risk of exploitation. Avoid using the argument content in the affected component until the issue is resolved.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2015-10073

GHSA-84MM-PRJG-49XM

Affected Products

Tinymighty Wikiseo

References · 9

• 🔥 https://github.com/tinymighty/wiki-seo/pull/21 · Exploit
• https://github.com/tinymighty/wiki-seo/commit/089a5797be612b18a820f9f1e6593ad9a91b1dba · Patch
• https://github.com/tinymighty/wiki-seo/releases/tag/1.2.2 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2015-10073 · Security Note
• https://osv.dev/vulnerability/GHSA-84mm-prjg-49xm · Vendor Advisory
• https://github.com/tinymighty/wiki-seo · Note
• https://vuldb.com/?id.220215 · Note
• https://t.me/cvenotify/59790 · Telegram Post
• https://vuldb.com/?ctiid.220215 · Note