A Cross-Site Scripting (XSS) was discovered in Gazelle before 2017-03-19. The vulnerability exists due to insufficient filtration of user-supplied data (type) passed to the 'Gazelle-master/sections/better/transcode.php' URL. An attacker could execute arbitrary HTML and script code in a browser in the context of the vulnerable website.
References
| Link | Resource |
|---|---|
| http://www.securityfocus.com/bid/97063 | Third Party Advisory VDB Entry |
| https://github.com/WhatCD/Gazelle/issues/111 | Issue Tracking Patch Third Party Advisory |
| https://github.com/scriptzteam/Gazelle---Torrent-Tracker-ANTi-XSS | Mitigation Third Party Advisory |
| http://www.securityfocus.com/bid/97063 | Third Party Advisory VDB Entry |
| https://github.com/WhatCD/Gazelle/issues/111 | Issue Tracking Patch Third Party Advisory |
| https://github.com/scriptzteam/Gazelle---Torrent-Tracker-ANTi-XSS | Mitigation Third Party Advisory |
Configurations
History
21 Nov 2024, 03:31
| Type | Values Removed | Values Added |
|---|---|---|
| References | () http://www.securityfocus.com/bid/97063 - Third Party Advisory, VDB Entry | |
| References | () https://github.com/WhatCD/Gazelle/issues/111 - Issue Tracking, Patch, Third Party Advisory | |
| References | () https://github.com/scriptzteam/Gazelle---Torrent-Tracker-ANTi-XSS - Mitigation, Third Party Advisory |
Information
Published : 2017-03-23 22:59
Updated : 2024-11-21 03:31
NVD link : CVE-2017-7248
Mitre link : CVE-2017-7248
CVE.ORG link : CVE-2017-7248
JSON object : View
Products Affected
gazelle_project
- gazelle
CWE
CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')