** DISPUTED ** Multiple cross-site scripting (XSS) vulnerabilities in BigTree CMS through 4.2.18 allow remote authenticated users to inject arbitrary web script or HTML by uploading a crafted package, triggering mishandling of the (1) title or (2) version or (3) author_name parameter in manifest.json. This issue exists in core\admin\modules\developer\extensions\install\unpack.php and core\admin\modules\developer\packages\install\unpack.php. NOTE: the vendor states "You must implicitly trust any package or extension you install as they all have the ability to write PHP files."
References
Link | Resource |
---|---|
https://github.com/bigtreecms/BigTree-CMS/issues/290 | Issue Tracking Patch Third Party Advisory |
https://github.com/bigtreecms/BigTree-CMS/issues/290 | Issue Tracking Patch Third Party Advisory |
Configurations
History
21 Nov 2024, 03:36
Type | Values Removed | Values Added |
---|---|---|
References | () https://github.com/bigtreecms/BigTree-CMS/issues/290 - Issue Tracking, Patch, Third Party Advisory |
16 Aug 2024, 15:35
Type | Values Removed | Values Added |
---|---|---|
CVSS |
v2 : v3 : |
v2 : 3.5
v3 : 2.7 |
Information
Published : 2017-06-05 19:29
Updated : 2024-11-21 03:36
NVD link : CVE-2017-9441
Mitre link : CVE-2017-9441
CVE.ORG link : CVE-2017-9441
JSON object : View
Products Affected
bigtreecms
- bigtree_cms
CWE
CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')