CVE-2017-16568

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2017-16568
Persistent Cross-Site Scripting (XSS) vulnerability in Logitech Media Server 7.9.0, affecting the "Radio" functionality. This vulnerability allows attackers to inject malicious JavaScript payloads, which become permanently stored on the server and execute when a user plays the compromised radio stream. Exploitation of this vulnerability can lead to Session hijacking and unauthorized access, Persistent manipulation of web content within the application, and Phishing or malicious redirects to external domains. This vulnerability can be exploited to manipulate media server behavior in enterprise and home network environments.

5.4 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 2.3 / Impact : 2.7

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction REQUIRED

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact NONE

Scope CHANGED

3.5 /10

CVSS v2.0 : LOW

V2 Legend

Vector : AV:N/AC:M/Au:S/C:N/I:P/A:N

Exploitability : 6.8 / Impact : 2.9

Access Vector NETWORK

Access Complexity MEDIUM

Authentication SINGLE

Confidentiality Impact NONE

Integrity Impact PARTIAL

Availability Impact NONE

References
Link Resource
https://www.exploit-db.com/exploits/43123/ Third Party Advisory VDB Entry
https://www.exploit-db.com/exploits/43123/ Third Party Advisory VDB Entry
Configurations

Configuration 1 (hide)

cpe:2.3:a:logitech:media_server:7.9.0:*:*:*:*:*:*:*
History

04 Feb 2025, 22:15

Type Values Removed Values Added
Summary (en) Cross-site scripting (XSS) vulnerability in Logitech Media Server 7.9.0 allows remote attackers to inject arbitrary web script or HTML via a radio URL. (en) Persistent Cross-Site Scripting (XSS) vulnerability in Logitech Media Server 7.9.0, affecting the "Radio" functionality. This vulnerability allows attackers to inject malicious JavaScript payloads, which become permanently stored on the server and execute when a user plays the compromised radio stream. Exploitation of this vulnerability can lead to Session hijacking and unauthorized access, Persistent manipulation of web content within the application, and Phishing or malicious redirects to external domains. This vulnerability can be exploited to manipulate media server behavior in enterprise and home network environments.

21 Nov 2024, 03:16

Type Values Removed Values Added
References () https://www.exploit-db.com/exploits/43123/ - Third Party Advisory, VDB Entry () https://www.exploit-db.com/exploits/43123/ - Third Party Advisory, VDB Entry
Information

Published : 2017-11-10 02:29

Updated : 2025-02-04 22:15

NVD link : CVE-2017-16568

Mitre link : CVE-2017-16568

CVE.ORG link : CVE-2017-16568

JSON object : View

Products Affected

logitech

  • media_server
CWE
CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')