CVE-2017-6538

2017-03-0808:59:00

Google

osv.dev

5.9 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

40.9%

JSON

A Cross-Site Scripting (XSS) issue was discovered in webpagetest 3.0. The vulnerability exists due to insufficient filtration of user-supplied data (video) passed to the webpagetest-master/www/speedindex/index.php URL. An attacker could execute arbitrary HTML and script code in a browser in the context of the vulnerable website.

CPENameOperatorVersion
webpagetesteqWebPagetest-2.12
webpagetesteqstable
webpagetesteqWebPageTest-2.18
webpagetesteq2.13
webpagetesteqWebPageTest-2.19
webpagetesteqWebPageTest-2.16
webpagetesteqWebPageTest-2.17
webpagetesteqWebPagetest-2.15
webpagetesteqWebPageTest-3.0
webpagetesteqWebPagetest-2.14

Name	Operator	Version
webpagetest	eq	WebPagetest-2.12
webpagetest	eq	stable
webpagetest	eq	WebPageTest-2.18
webpagetest	eq	2.13
webpagetest	eq	WebPageTest-2.19
webpagetest	eq	WebPageTest-2.16
webpagetest	eq	WebPageTest-2.17
webpagetest	eq	WebPagetest-2.15
webpagetest	eq	WebPageTest-3.0
webpagetest	eq	WebPagetest-2.14