CVE-2017-16567: XSS
Cross-site scripting (XSS) vulnerability in Logitech Media Server 7.9.0 allows remote attackers to inject arbitrary web script or HTML via a "favorite."
Other sources
Persistent Cross-Site Scripting (XSS) vulnerability in Logitech Media Server 7.9.0, affecting the "Favorites" feature. This vulnerability allows remote attackers to inject and permanently store malicious JavaScript payloads, which are executed when users access the affected functionality. Exploitation of this vulnerability can lead to Session Hijacking and Credential Theft, Execution of unauthorized actions on behalf of users, and Exfiltration of sensitive data. This vulnerability presents a potential risk for widespread exploitation in connected IoT environments.
— MITRE
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2017-16567?
The severity of CVE-2017-16567 is rated as high due to its potential for remote code execution through Cross-Site Scripting.
How do I fix CVE-2017-16567?
To fix CVE-2017-16567, update Logitech Media Server to the latest version provided by Logitech.
What type of attacks can CVE-2017-16567 enable?
CVE-2017-16567 can enable remote attackers to execute arbitrary web scripts or HTML through the "Favorites" feature.
In which software is CVE-2017-16567 found?
CVE-2017-16567 is found in Logitech Media Server version 7.9.0.
What is Cross-Site Scripting in the context of CVE-2017-16567?
In the context of CVE-2017-16567, Cross-Site Scripting is a vulnerability that allows attackers to inject malicious scripts into web pages viewed by other users.