CVE-2017-15215: XSS

Published Oct 10, 2017

Updated

Reflected XSS vulnerability in Shaarli v0.9.1 allows an unauthenticated attacker to inject JavaScript via the searchtags parameter to index.php. If the victim is an administrator, an attacker can (for example) take over the admin session or change global settings or add/delete links. It is also possible to execute JavaScript against unauthenticated users.

Affected Software

1 affected component

Shaarli Project Shaarli=0.9.1

Remediation

Patch Available

http://openwall.com/lists/oss-security/2017/10/07/2

Event History

Oct 10, 2017

CVE Published

via MITRE·05:00 AM

Data Sourced

via MITRE·05:00 AM

Description

Frequently Asked Questions

What is the severity of CVE-2017-15215?

CVE-2017-15215 is classified as a high severity vulnerability due to its potential impact on administrator accounts.

How do I fix CVE-2017-15215?

To fix CVE-2017-15215, you should upgrade Shaarli to version 0.9.2 or later.

What type of vulnerability is CVE-2017-15215?

CVE-2017-15215 is a reflected cross-site scripting (XSS) vulnerability.

Who can be affected by CVE-2017-15215?

CVE-2017-15215 can affect any user of Shaarli v0.9.1, particularly administrators who may have their sessions hijacked.

What parameters are involved in CVE-2017-15215?

CVE-2017-15215 involves the 'searchtags' parameter in the index.php file.