Lucene search

MitreCVE-2020-17451

HistoryAug 09, 2020 - 7:15 p.m.

CVE-2020-17451

2020-08-0919:15:11

CWE-79

mitre

web.nvd.nist.gov

cve-2020-17451

flatcore

xss

admin

acp

security vulnerability

CVSS2

3.5

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

SINGLE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:S/C:N/I:P/A:N

CVSS3

4.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

AI Score

4.9

Confidence

High

EPSS

0.001

Percentile

32.0%

JSON

flatCore before 1.5.7 allows XSS by an admin via the acp/acp.php?tn=pages&sub=edit&editpage=1 page_linkname, page_title, page_content, or page_extracontent parameter, or the acp/acp.php?tn=system&sub=sys_pref prefs_pagename, prefs_pagetitle, or prefs_pagesubtitle parameter.

Affected configurations

Nvd

Node

flatcoreflatcoreRange<1.5.7

VendorProductVersionCPE
flatcoreflatcore*cpe:2.3:a:flatcore:flatcore:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
flatcore	flatcore	*	cpe:2.3:a:flatcore:flatcore::::::::

References

lists.openwall.net/full-disclosure/2020/08/07/1

sec-consult.com/en/blog/advisories/multiple-vulnerabilities-in-flatcore-cms/

CVSS2

3.5

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

SINGLE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:S/C:N/I:P/A:N

CVSS3

4.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

AI Score

4.9

Confidence

High

EPSS

0.001

Percentile

32.0%

JSON

Related for CVE-2020-17451