CVE-2017-6561: XSS

Published Mar 9, 2017

Updated

XSS in Agora-Project 3.2.2 exists with an index.php?ctrl=object&action=[XSS] attack.

Affected Software

1 affected component

Agora-Project Agora-Project=3.2.2

Event History

Mar 9, 2017

CVE Published

via MITRE·09:26 AM

Data Sourced

via MITRE·09:26 AM

Description

Data Sourced

via NVD·09:59 AM

DescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

What does an attacker need to exploit this issue?

The attack is network-accessible and requires no privileges, but it does require user interaction. An attacker would need to induce a user to access a crafted index.php URL using the ctrl=object parameter and an action value containing XSS payload.

What is the potential impact if exploitation succeeds?

The CVSS vector indicates low confidentiality and integrity impact, with scope changed. Availability impact is not indicated.

Which version is identified as affected?

The available data identifies Agora-Project 3.2.2 as affected. No fixed version or mitigation is provided.

CVE-2017-6561: XSS

Affected Software

Event History

Frequently Asked Questions

What does an attacker need to exploit this issue?

What is the potential impact if exploitation succeeds?

Which version is identified as affected?

Company

Resources

Contact

Frequently Asked Questions

What does an attacker need to exploit this issue?

What is the potential impact if exploitation succeeds?

Which version is identified as affected?