Lucene search

VulDBCVE-2017-20122

HistoryJun 30, 2022 - 5:15 a.m.

CVE-2017-20122

2022-06-3005:15:07

CWE-80

CWE-79

VulDB

web.nvd.nist.gov

bitrix site manager

vulnerability

contact form

cross-site scripting

remote attack

CVSS2

3.5

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

SINGLE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:S/C:N/I:P/A:N

CVSS3

5.4

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

EPSS

0.001

Percentile

21.4%

JSON

A vulnerability classified as problematic was found in Bitrix Site Manager 12.06.2015. Affected by this vulnerability is an unknown functionality of the component Contact Form. The manipulation of the argument text with the input <img src=“http://1” /> leads to basic cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.

Affected configurations

Nvd

Vulners

Node

bitrix24bitrix_site_managerMatch12.06.2015

VendorProductVersionCPE
bitrix24bitrix_site_manager12.06.2015cpe:2.3:a:bitrix24:bitrix_site_manager:12.06.2015:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
bitrix24	bitrix_site_manager	12.06.2015	cpe:2.3:a:bitrix24:bitrix_site_manager:12.06.2015:::::::*

CNA Affected

[
  {
    "product": "Site Manager",
    "vendor": "Bitrix",
    "versions": [
      {
        "status": "affected",
        "version": "12.06.2015"
      }
    ]
  }
]

References

seclists.org/fulldisclosure/2017/Feb/3

vuldb.com/?id.96643

Social References

CVSS2

3.5

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

SINGLE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:S/C:N/I:P/A:N

CVSS3

5.4

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

EPSS

0.001

Percentile

21.4%

JSON

Related for CVE-2017-20122