CVE-2024-27517: XSS

Published Feb 28, 2024

Updated

Webasyst 2.9.9 has a Cross-Site Scripting (XSS) vulnerability, Attackers can create blogs containing malicious code after gaining blog permissions.

Affected Software

1 affected component

Webasyst Webasyst=2.9.9

Event History

Feb 28, 2024

CVE Published

via MITRE·12:00 AM

Data Sourced

via MITRE·12:00 AM

Description

Feb 29, 2024

Data Sourced

via NVD·01:44 AM

DescriptionSeverityWeakness

Frequently Asked Questions

Who can exploit this issue?

An attacker needs blog permissions in Webasyst to create a blog containing malicious code. This is not an unauthenticated attack, because the CVSS vector requires low privileges.

Does exploitation require user interaction?

Yes. The CVSS vector indicates user interaction is required, so another user must interact with content containing the malicious code for the XSS to take effect.

What security impact can result from successful exploitation?

The CVSS vector indicates low confidentiality and integrity impact, with no availability impact. The scope is changed, meaning the effect can extend beyond the vulnerable component's security authority.

CVE-2024-27517: XSS

Affected Software

Event History

Frequently Asked Questions

Who can exploit this issue?

Does exploitation require user interaction?

What security impact can result from successful exploitation?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue?

Does exploitation require user interaction?

What security impact can result from successful exploitation?