CVE-2017-18177: XSS

Published Feb 12, 2018

Updated

Progress Sitefinity 9.1 has XSS via the Last name, First name, and About fields on the New User Creation Page. This is fixed in 10.1.

Affected Software

1 affected component

Progress Sitefinity=9.1

Event History

Feb 12, 2018

CVE Published

via MITRE·02:00 PM

Data Sourced

via MITRE·02:00 PM

Description

Frequently Asked Questions

What is CVE-2017-18177?

CVE-2017-18177 is a vulnerability in Progress Sitefinity 9.1 that allows cross-site scripting (XSS) attacks via the Last name, First name, and About fields on the New User Creation Page.

How severe is CVE-2017-18177?

The severity of CVE-2017-18177 is medium with a CVSS score of 5.4.

How can I fix CVE-2017-18177?

To fix CVE-2017-18177, update Progress Sitefinity to version 10.1 or higher.

Is there any additional information about CVE-2017-18177?

Yes, you can find additional information about CVE-2017-18177 at the following references: [Link 1](https://packetstormsecurity.com/files/143894/Progress-Sitefinity-9.1-XSS-Session-Management-Open-Redirect.html), [Link 2](https://www.sec-consult.com/en/blog/advisories/multiple-vulnerabilities-in-progress-sitefinity/index.html).

What is the Common Weakness Enumeration (CWE) ID for CVE-2017-18177?

The CWE ID for CVE-2017-18177 is CWE-79, which refers to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting').