CVE-2017-7248: XSS
A Cross-Site Scripting (XSS) was discovered in Gazelle before 2017-03-19. The vulnerability exists due to insufficient filtration of user-supplied data (type) passed to the 'Gazelle-master/sections/better/transcode.php' URL. An attacker could execute arbitrary HTML and script code in a browser in the context of the vulnerable website.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2017-7248?
CVE-2017-7248 is classified as a medium severity cross-site scripting vulnerability.
How do I fix CVE-2017-7248?
To fix CVE-2017-7248, update Gazelle to a version released after March 19, 2017, that includes proper input validation measures.
What types of attacks can be performed using CVE-2017-7248?
An attacker can leverage CVE-2017-7248 to execute arbitrary HTML and JavaScript in a user's browser.
Which versions of Gazelle are affected by CVE-2017-7248?
Gazelle versions up to and including 2016-11-01 are affected by CVE-2017-7248.
Where does CVE-2017-7248 occur in the Gazelle application?
CVE-2017-7248 occurs in the 'Gazelle-master/sections/better/transcode.php' URL due to insufficient filtration of user input.