CVE-2017-6905: XSS
An issue was discovered in concrete5 <= 5.6.3.4. The vulnerability exists due to insufficient filtration of user-supplied data (disablechoose) passed to the "concrete5-legacy-master/web/concrete/tools/files/searchdialog.php" URL. An attacker could execute arbitrary HTML and script code in a browser in the context of the vulnerable website.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2017-6905?
CVE-2017-6905 is considered a high severity vulnerability due to its potential for remote code execution.
How do I fix CVE-2017-6905?
To fix CVE-2017-6905, you should upgrade Concrete5 to version 5.6.4 or later, where the vulnerability has been patched.
What systems are affected by CVE-2017-6905?
CVE-2017-6905 affects Concrete5 versions up to and including 5.6.3.4.
What type of attack can exploit CVE-2017-6905?
CVE-2017-6905 can be exploited by attackers to execute arbitrary HTML and script code in the context of the user's browser.
Is user input validation impacted by CVE-2017-6905?
Yes, CVE-2017-6905 is due to insufficient filtration of user-supplied data, highlighting a major flaw in input validation.