Stored XSS vulnerability in Flyspray before 1.0-rc6 allows an authenticated user to inject JavaScript to gain administrator privileges, via the real_name or email_address field to themes/CleanFS/templates/common.editallusers.tpl.
References
| Link | Resource |
|---|---|
| http://openwall.com/lists/oss-security/2017/10/07/1 | Mailing List Patch Third Party Advisory VDB Entry |
| https://github.com/Flyspray/flyspray/commit/754ec5d04348ef7ecb8cb02ade976dc412b031f8 | Patch Third Party Advisory |
| https://github.com/Flyspray/flyspray/releases/tag/v1.0-rc6 | Release Notes Third Party Advisory |
| http://openwall.com/lists/oss-security/2017/10/07/1 | Mailing List Patch Third Party Advisory VDB Entry |
| https://github.com/Flyspray/flyspray/commit/754ec5d04348ef7ecb8cb02ade976dc412b031f8 | Patch Third Party Advisory |
| https://github.com/Flyspray/flyspray/releases/tag/v1.0-rc6 | Release Notes Third Party Advisory |
Configurations
History
21 Nov 2024, 03:14
| Type | Values Removed | Values Added |
|---|---|---|
| References | () http://openwall.com/lists/oss-security/2017/10/07/1 - Mailing List, Patch, Third Party Advisory, VDB Entry | |
| References | () https://github.com/Flyspray/flyspray/commit/754ec5d04348ef7ecb8cb02ade976dc412b031f8 - Patch, Third Party Advisory | |
| References | () https://github.com/Flyspray/flyspray/releases/tag/v1.0-rc6 - Release Notes, Third Party Advisory |
Information
Published : 2017-10-11 01:32
Updated : 2024-11-21 03:14
NVD link : CVE-2017-15213
Mitre link : CVE-2017-15213
CVE.ORG link : CVE-2017-15213
JSON object : View
Products Affected
flyspray
- flyspray
CWE
CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')