CVE-2017-9145: XSS
Published Jun 26, 2017
·Updated
TikiFilter.php in Tiki Wiki CMS Groupware 12.x through 16.x does not properly validate the imgsize or lang parameter to prevent XSS.
Affected Software
23 affected components
Tiki Wiki CMS Groupware=12.0
Tiki Wiki CMS Groupware=12.1
Tiki Wiki CMS Groupware=12.2
Tiki Wiki CMS Groupware=12.3
Tiki Wiki CMS Groupware=12.4
Tiki Wiki CMS Groupware=12.5
Tiki Wiki CMS Groupware=12.6
Tiki Wiki CMS Groupware=12.7
Tiki Wiki CMS Groupware=12.8
Tiki Wiki CMS Groupware=12.9
Tiki Wiki CMS Groupware=13.0
Tiki Wiki CMS Groupware=13.1
Tiki Wiki CMS Groupware=13.2
Tiki Wiki CMS Groupware=14.0
Tiki Wiki CMS Groupware=14.1
Tiki Wiki CMS Groupware=15.0
Tiki Wiki CMS Groupware=15.1
Tiki Wiki CMS Groupware=15.2
Tiki Wiki CMS Groupware=15.3
Tiki Wiki CMS Groupware=15.4
Tiki Wiki CMS Groupware=16.0
Tiki Wiki CMS Groupware=16.1
Tiki Wiki CMS Groupware=16.2
Remediation
Patch Available
Event History
Jun 26, 2017
CVE Published
via MITRE·01:00 PM
Data Sourced
via MITRE·01:00 PM
Description
Frequently Asked Questions
1
What is the severity of CVE-2017-9145?
CVE-2017-9145 has been classified as a moderate severity vulnerability.
2
How do I fix CVE-2017-9145?
To fix CVE-2017-9145, upgrade Tiki Wiki CMS Groupware to version 16.3 or later.
3
What types of attacks can CVE-2017-9145 facilitate?
CVE-2017-9145 can facilitate cross-site scripting (XSS) attacks due to improper validation of parameters.
4
Which versions of Tiki Wiki are affected by CVE-2017-9145?
CVE-2017-9145 affects Tiki Wiki CMS Groupware versions 12.x through 16.x.
5
Is CVE-2017-9145 exploitable without authentication?
Yes, CVE-2017-9145 can be exploited without authentication, making it particularly dangerous.