CVE-2017-15872: XSS
Published Oct 24, 2017
·Updated
phpwcms 1.8.9 has XSS in include/inctmpl/admin.edituser.tmpl.php and include/inctmpl/admin.newuser.tmpl.php via the username (aka newlogin) field.
Affected Software
1 affected component
Phpwcms Phpwcms=1.8.9
Remediation
Event History
Oct 24, 2017
CVE Published
via MITRE·08:00 PM
Data Sourced
via MITRE·08:00 PM
Description
Frequently Asked Questions
1
What is the severity of CVE-2017-15872?
CVE-2017-15872 is classified as a cross-site scripting (XSS) vulnerability which can lead to unauthorized access to user accounts.
2
How do I fix CVE-2017-15872?
To fix CVE-2017-15872, upgrade phpwcms to a later version that addresses this XSS vulnerability.
3
What versions of phpwcms are affected by CVE-2017-15872?
CVE-2017-15872 affects phpwcms version 1.8.9.
4
What are the potential impacts of CVE-2017-15872?
The potential impacts of CVE-2017-15872 include session hijacking and the execution of arbitrary scripts in the context of the user's browser.
5
Is there a workaround for CVE-2017-15872?
A potential workaround for CVE-2017-15872 is to sanitize user input in the username field to prevent malicious script execution.