CVE-2017-7249: XSS
Multiple Cross-Site Scripting (XSS) were discovered in Gazelle before 2017-03-19. The vulnerabilities exist due to insufficient filtration of user-supplied data (action, userid) passed to the 'Gazelle-master/sections/tools/data/ocelotinfo.php' URL. An attacker could execute arbitrary HTML and script code in a browser in the context of the vulnerable website.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2017-7249?
CVE-2017-7249 has a medium severity rating due to its potential for exploitation through Cross-Site Scripting (XSS).
How do I fix CVE-2017-7249?
To fix CVE-2017-7249, ensure user input is properly sanitized and validated before being processed by the application.
Which versions of Gazelle are affected by CVE-2017-7249?
CVE-2017-7249 affects all versions of Gazelle prior to November 1, 2016.
What types of attacks are possible with CVE-2017-7249?
CVE-2017-7249 allows attackers to execute arbitrary HTML and scripts, potentially leading to account hijacking or data theft.
Is there a known exploit for CVE-2017-7249?
Yes, there are public discussions and reports about exploits leveraging the Cross-Site Scripting vulnerabilities identified in CVE-2017-7249.