CVE-2017-17911: XSS

Published Dec 26, 2017

Updated

packages/core/contact.php in Archon 3.21 rev-1 has XSS in the referer parameter in an index.php?p=core/contact request, aka Open Bug Bounty ID OBB-278503.

Affected Software

1 affected component

Archon Archon=3.21

Event History

Dec 26, 2017

CVE Published

via MITRE·07:00 PM

Data Sourced

via MITRE·07:00 PM

Description

Frequently Asked Questions

What does an attacker need to exploit this issue?

The attacker needs to cause a victim to make an index.php?p=core/contact request with a crafted referer parameter. Exploitation requires user interaction, as reflected by the CVSS UI:R vector.

What is the likely impact if exploitation succeeds?

Successful exploitation can lead to cross-site scripting in the victim's browser. The CVSS vector indicates low confidentiality and integrity impact, with no availability impact.

Is authentication required to exploit the vulnerability?

No. The CVSS vector includes PR:N, indicating that the attacker does not need privileges or authentication before attempting exploitation.

CVE-2017-17911: XSS

Affected Software

Event History

Frequently Asked Questions

What does an attacker need to exploit this issue?

What is the likely impact if exploitation succeeds?

Is authentication required to exploit the vulnerability?

Company

Resources

Contact

Frequently Asked Questions

What does an attacker need to exploit this issue?

What is the likely impact if exploitation succeeds?

Is authentication required to exploit the vulnerability?