CVE-2017-7250: XSS
A Cross-Site Scripting (XSS) was discovered in Gazelle before 2017-03-19. The vulnerability exists due to insufficient filtration of user-supplied data (action) passed to the 'Gazelle-master/sections/tools/finances/bitcoinbalance.php' URL. An attacker could execute arbitrary HTML and script code in a browser in the context of the vulnerable website.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2017-7250?
CVE-2017-7250 has a medium severity rating due to its potential for allowing Cross-Site Scripting (XSS) attacks.
How do I fix CVE-2017-7250?
To fix CVE-2017-7250, ensure that user-supplied data is adequately filtered and sanitized before rendering it in the application.
What types of attacks are possible with CVE-2017-7250?
CVE-2017-7250 allows attackers to execute arbitrary HTML and script code in users' browsers through Cross-Site Scripting.
Which versions of Gazelle are affected by CVE-2017-7250?
CVE-2017-7250 affects all versions of Gazelle prior to 2016-11-01.
What can an attacker gain by exploiting CVE-2017-7250?
An attacker exploiting CVE-2017-7250 can gain access to session tokens, cookies, or other sensitive information stored in the user's browser.