CVE-2017-6559: XSS
Published Mar 9, 2017
·Updated
XSS in Agora-Project 3.2.2 exists with an index.php?disconnect=1&msgNotif[]=[XSS] attack.
Affected Software
1 affected component
Agora-Project Agora-Project=3.2.2
Event History
Mar 9, 2017
CVE Published
via MITRE·09:26 AM
Data Sourced
via MITRE·09:26 AM
Description
Data Sourced
via NVD·09:59 AM
DescriptionSeverityWeaknessAffected Software
Frequently Asked Questions
1
What does an attacker need to exploit this issue?
The attacker needs to cause a user to interact with a crafted URL containing the malicious msgNotif[] parameter. The CVSS vector indicates the attack can be delivered remotely, requires no privileges, and requires user interaction.
2
What is the potential impact if exploitation succeeds?
Successful exploitation can run attacker-supplied script in the affected web application's context. The supplied CVSS data indicates low confidentiality and integrity impact, with no availability impact, and that the impact scope may extend beyond the vulnerable component.
3
Which version is identified as affected?
The available data identifies Agora-Project version 3.2.2 as affected. No fixed version or mitigation is provided.