CVE-2017-18176

2018-02-1214:00:00

mitre

www.cve.org

progress sitefinity

xss

file upload

javascript

html

same origin

application code

cve-2017-18176

fixed

EPSS

0.001

Percentile

45.8%

JSON

Progress Sitefinity 9.1 has XSS via file upload, because JavaScript code in an HTML file has the same origin as the application’s own code. This is fixed in 10.1.

References

packetstormsecurity.com/files/143894/Progress-Sitefinity-9.1-XSS-Session-Management-Open-Redirect.html

www.sec-consult.com/en/blog/advisories/multiple-vulnerabilities-in-progress-sitefinity/index.html

EPSS

0.001

Percentile

45.8%

JSON

Related for CVELIST:CVE-2017-18176