CVE-2016-1205: XSS

Published Apr 28, 2016

Updated

Cross-site scripting (XSS) vulnerability in the shiro8 (1) categoryfreearea additionplugin plugin 1.0 and (2) itemdetailfreearea additionplugin plugin 1.0 for EC-CUBE allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

Affected Software

2 affected components

shiro8 Category Freearea Addition Ec-cube=1.0

shiro8 Itemdetail Freearea Addition Ec-cube=1.0

Event History

Apr 28, 2016

CVE Published

via MITRE·01:00 AM

Data Sourced

via MITRE·01:00 AM

Description

Frequently Asked Questions

What is the severity of CVE-2016-1205?

CVE-2016-1205 is classified as a medium severity vulnerability that allows cross-site scripting (XSS) attacks.

How do I fix CVE-2016-1205?

To fix CVE-2016-1205, update the vulnerable Shiro8 plugins to their latest secure versions.

What types of attacks can be executed due to CVE-2016-1205?

CVE-2016-1205 allows remote attackers to inject arbitrary web scripts or HTML into the affected applications.

Which software versions are affected by CVE-2016-1205?

CVE-2016-1205 affects the shiro8 category_freearea_addition_plugin and itemdetail_freearea_addition_plugin, both version 1.0.

Who is at risk from CVE-2016-1205?

Web applications using the affected versions of the shiro8 plugins are at risk of exploitation from cross-site scripting vulnerabilities.