CVE-2016-2784: XSS
Published May 26, 2016
·Updated
CMS Made Simple 2.x before 2.1.3 and 1.x before 1.12.2, when Smarty Cache is activated, allow remote attackers to conduct cache poisoning attacks, modify links, and conduct cross-site scripting (XSS) attacks via a crafted HTTP Host header in a request.
Affected Software
80 affected components
CMSmadesimple CMS Made Simple=1.0
CMSmadesimple CMS Made Simple=1.0.1
CMSmadesimple CMS Made Simple=1.0.2
CMSmadesimple CMS Made Simple=1.0.3
CMSmadesimple CMS Made Simple=1.0.4
CMSmadesimple CMS Made Simple=1.0.5
CMSmadesimple CMS Made Simple=1.0.6
CMSmadesimple CMS Made Simple=1.0.7
CMSmadesimple CMS Made Simple=1.0.8
CMSmadesimple CMS Made Simple=1.1
CMSmadesimple CMS Made Simple=1.1.1
CMSmadesimple CMS Made Simple=1.1.2
CMSmadesimple CMS Made Simple=1.1.3.1
CMSmadesimple CMS Made Simple=1.1.4.1
CMSmadesimple CMS Made Simple=1.2
CMSmadesimple CMS Made Simple=1.2.1
CMSmadesimple CMS Made Simple=1.2.2
CMSmadesimple CMS Made Simple=1.2.3
CMSmadesimple CMS Made Simple=1.2.4
CMSmadesimple CMS Made Simple=1.2.5
CMSmadesimple CMS Made Simple=1.3
CMSmadesimple CMS Made Simple=1.3.1
CMSmadesimple CMS Made Simple=1.4
CMSmadesimple CMS Made Simple=1.4.1
CMSmadesimple CMS Made Simple=1.5
CMSmadesimple CMS Made Simple=1.5.1
CMSmadesimple CMS Made Simple=1.5.2
CMSmadesimple CMS Made Simple=1.5.3
CMSmadesimple CMS Made Simple=1.5.4
CMSmadesimple CMS Made Simple=1.6
CMSmadesimple CMS Made Simple=1.6.1
CMSmadesimple CMS Made Simple=1.6.2
CMSmadesimple CMS Made Simple=1.6.3
CMSmadesimple CMS Made Simple=1.6.4
CMSmadesimple CMS Made Simple=1.6.5
CMSmadesimple CMS Made Simple=1.6.6
CMSmadesimple CMS Made Simple=1.6.7
CMSmadesimple CMS Made Simple=1.6.8
CMSmadesimple CMS Made Simple=1.6.9
CMSmadesimple CMS Made Simple=1.6.10
CMSmadesimple CMS Made Simple=1.7
CMSmadesimple CMS Made Simple=1.7.1
CMSmadesimple CMS Made Simple=1.8
CMSmadesimple CMS Made Simple=1.8.1
CMSmadesimple CMS Made Simple=1.8.2
CMSmadesimple CMS Made Simple=1.9
CMSmadesimple CMS Made Simple=1.9.1
CMSmadesimple CMS Made Simple=1.9.2
CMSmadesimple CMS Made Simple=1.9.3
CMSmadesimple CMS Made Simple=1.9.4
CMSmadesimple CMS Made Simple=1.9.4.1
CMSmadesimple CMS Made Simple=1.9.4.2
CMSmadesimple CMS Made Simple=1.9.4.3
CMSmadesimple CMS Made Simple=1.10
CMSmadesimple CMS Made Simple=1.10.1
CMSmadesimple CMS Made Simple=1.10.2
CMSmadesimple CMS Made Simple=1.10.3
CMSmadesimple CMS Made Simple=1.11
CMSmadesimple CMS Made Simple=1.11.1
CMSmadesimple CMS Made Simple=1.11.2
CMSmadesimple CMS Made Simple=1.11.2.1
CMSmadesimple CMS Made Simple=1.11.3
CMSmadesimple CMS Made Simple=1.11.4
CMSmadesimple CMS Made Simple=1.11.5
CMSmadesimple CMS Made Simple=1.11.6
CMSmadesimple CMS Made Simple=1.11.7
CMSmadesimple CMS Made Simple=1.11.8
CMSmadesimple CMS Made Simple=1.11.9
CMSmadesimple CMS Made Simple=1.11.10
CMSmadesimple CMS Made Simple=1.11.11
CMSmadesimple CMS Made Simple=1.11.12
CMSmadesimple CMS Made Simple=1.11.13
CMSmadesimple CMS Made Simple=1.12
CMSmadesimple CMS Made Simple=1.12.1
CMSmadesimple CMS Made Simple=2.0
CMSmadesimple CMS Made Simple=2.0.1
CMSmadesimple CMS Made Simple=2.0.1.1
CMSmadesimple CMS Made Simple=2.1
CMSmadesimple CMS Made Simple=2.1.1
CMSmadesimple CMS Made Simple=2.1.2
Event History
May 26, 2016
CVE Published
via MITRE·02:00 PM
Data Sourced
via MITRE·02:00 PM
Description
Frequently Asked Questions
1
What is the severity of CVE-2016-2784?
CVE-2016-2784 has been classified as a medium severity vulnerability due to its potential for cache poisoning and XSS attacks.
2
How do I fix CVE-2016-2784?
To fix CVE-2016-2784, you should upgrade to CMS Made Simple version 2.1.3 or 1.12.2 or higher.
3
What types of attacks can CVE-2016-2784 be used for?
CVE-2016-2784 can be exploited for cache poisoning attacks and cross-site scripting (XSS) attacks.
4
Which versions of CMS Made Simple are affected by CVE-2016-2784?
CVE-2016-2784 affects CMS Made Simple versions 2.x before 2.1.3 and 1.x before 1.12.2.
5
What does CVE-2016-2784 exploit to conduct attacks?
CVE-2016-2784 exploits vulnerabilities in the Smarty Cache feature by manipulating the HTTP Host header.