CVE-2017-16636: XSS
In Bludit v1.5.2 and v2.0.1, an XSS vulnerability is located in the new page, new category, and edit post function body message context. Remote attackers are able to bypass the basic editor validation to trigger cross site scripting. The XSS is persistent and the request method to inject via editor is GET. To save the editor context, the followup POST method request must be processed to perform the attack via the application side. The basic validation of the editor does not allow injecting script codes and blocks the context. Attackers can inject the code by using an editor tag that is not recognized by the basic validation. Thus allows a restricted user account to inject malicious script code to perform a persistent attack against higher privilege web-application user accounts.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2017-16636?
The severity of CVE-2017-16636 is medium with a CVSS score of 5.4.
What is the affected software for CVE-2017-16636?
The affected software for CVE-2017-16636 is Bludit versions 1.5.2 and 2.0.1.
How can an attacker exploit CVE-2017-16636?
An attacker can exploit CVE-2017-16636 by bypassing basic editor validation and triggering cross-site scripting (XSS) in the new page, new category, and edit post function body message context.
Is the XSS vulnerability in CVE-2017-16636 persistent?
Yes, the XSS vulnerability in CVE-2017-16636 is persistent, allowing remote attackers to inject malicious code.
Is there a fix available for CVE-2017-16636?
Yes, there is a fix available for CVE-2017-16636. It is recommended to update to a patched version of Bludit.