Lucene search

MitreCVE-2015-1562

HistoryFeb 09, 2015 - 11:59 a.m.

CVE-2015-1562

2015-02-0911:59:06

CWE-79

mitre

web.nvd.nist.gov

cve-2015-1562

cross-site scripting

xss

saurus cms

vulnerabilities

remote attackers

web script

html

admin

user management

profile data

error log

CVSS2

4.3

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:N/I:P/A:N

AI Score

5.9

Confidence

High

EPSS

0.016

Percentile

87.8%

JSON

Multiple cross-site scripting (XSS) vulnerabilities in Saurus CMS 4.7.0 allow remote attackers to inject arbitrary web script or HTML via the (1) search parameter to admin/user_management.php, (2) data_search parameter to /admin/profile_data.php, or (3) filter parameter to error_log.php.

Affected configurations

Nvd

Node

saurussaurus_cmsMatch4.7.0

VendorProductVersionCPE
saurussaurus_cms4.7.0cpe:2.3:a:saurus:saurus_cms:4.7.0:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
saurus	saurus_cms	4.7.0	cpe:2.3:a:saurus:saurus_cms:4.7.0:::::::*

References

seclists.org/fulldisclosure/2015/Jan/112

sroesemann.blogspot.de/2015/01/report-for-advisory-sroeadv-2015-05.html

sroesemann.blogspot.de/2015/01/sroeadv-2015-05.html

www.openwall.com/lists/oss-security/2015/01/28/8

github.com/sauruscms/Saurus-CMS-Community-Edition/commit/8dec044d0fdabcb9b04e58037623385a97b0d288

CVSS2

4.3

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:N/I:P/A:N

AI Score

5.9

Confidence

High

EPSS

0.016

Percentile

87.8%

JSON

Related for CVE-2015-1562