CVE-2018-14971: XSS
Published Aug 6, 2018
·Updated
An issue was discovered in QCMS 3.0.1. upload/System/Controller/backend/user.php has XSS.
Affected Software
1 affected component
Q-cms Qcms=3.0.1
Event History
Aug 6, 2018
CVE Published
via MITRE·03:00 PM
Data Sourced
via MITRE·03:00 PM
Description
Frequently Asked Questions
1
What level of access and interaction does exploitation require?
Exploitation requires network access, high privileges, and user interaction. The CVSS vector indicates low attack complexity, but an attacker must already have elevated access and persuade another user to interact with the injected content.
2
What is the expected security impact of successful exploitation?
Successful exploitation can affect confidentiality and integrity at a scope beyond the vulnerable component, while availability impact is not indicated. The reported impacts are low for confidentiality and integrity.
3
How can I identify potentially affected deployments?
The affected location is upload/System/Controller/backend/user.php in QCMS 3.0.1. Review deployments using that version and inspect this backend user-management controller for XSS exposure.