CVE-2015-6810: XSS
Published Sep 4, 2015
·Updated
Cross-site scripting (XSS) vulnerability in Invision Power Services IPS Community Suite (aka Invision Power Board, IPB, or Power Board) 4.x before 4.0.12.1 allows remote authenticated users to inject arbitrary web script or HTML via the eventlocation[address] array parameter to calendar/submit/.
Affected Software
14 affected components
Invisionpower Invision Power Board=4.0.0
Invisionpower Invision Power Board=4.0.1
Invisionpower Invision Power Board=4.0.2
Invisionpower Invision Power Board=4.0.3
Invisionpower Invision Power Board=4.0.4
Invisionpower Invision Power Board=4.0.5.1
Invisionpower Invision Power Board=4.0.6.1
Invisionpower Invision Power Board=4.0.7
Invisionpower Invision Power Board=4.0.8
Invisionpower Invision Power Board=4.0.8.1
Invisionpower Invision Power Board=4.0.9.2
Invisionpower Invision Power Board=4.0.10.2
Invisionpower Invision Power Board=4.0.11
Invisionpower Invision Power Board=4.0.12
Event History
Sep 4, 2015
CVE Published
via MITRE·03:00 PM
Data Sourced
via MITRE·03:00 PM
Description
Frequently Asked Questions
1
What is the severity of CVE-2015-6810?
CVE-2015-6810 is classified as a medium-severity cross-site scripting vulnerability.
2
How do I fix CVE-2015-6810?
To fix CVE-2015-6810, update your Invision Power Board to version 4.0.12.1 or later.
3
What versions of Invision Power Board are affected by CVE-2015-6810?
CVE-2015-6810 affects Invision Power Board versions 4.0.0 through 4.0.11.
4
Who can exploit CVE-2015-6810?
CVE-2015-6810 can be exploited by remote authenticated users.
5
What type of attack can CVE-2015-6810 facilitate?
CVE-2015-6810 can facilitate cross-site scripting (XSS) attacks, allowing attackers to inject arbitrary web scripts or HTML.