CVE-2017-6560: XSS
Published Mar 9, 2017
·Updated
XSS in Agora-Project 3.2.2 exists with an index.php?ctrl=misc&action=[XSS]&editObjId=[XSS] attack.
Affected Software
1 affected component
Agora-Project Agora-Project=3.2.2
Event History
Mar 9, 2017
CVE Published
via MITRE·09:26 AM
Data Sourced
via MITRE·09:26 AM
Description
Data Sourced
via NVD·09:59 AM
DescriptionSeverityWeaknessAffected Software
Frequently Asked Questions
1
What does an attacker need to exploit this issue?
The CVSS vector indicates that exploitation can be performed remotely without authentication and with low complexity, but requires user interaction. An attacker would need to entice a user into visiting a crafted request targeting index.php with the ctrl=misc parameter and malicious action and/or editObjId values.
2
What is the likely impact if exploitation succeeds?
The vulnerability is an XSS issue with low confidentiality and integrity impact and no availability impact in the supplied CVSS data. Because the scope is changed, the impact may extend beyond the vulnerable component's immediate security context.