CVE-2013-3728
low
CVSS v3
—
CVSS v2
3.5
VIR risk
3.5
Description
Cross-site scripting (XSS) vulnerability in Kasseler CMS before 2 r1232 allows remote authenticated users with permissions to create categories to inject arbitrary web script or HTML via the cat parameter in an admin_new_category action to admin.php.
Predictions
Exploit likelihood
20%
Patch ETA
—
Heuristic predictions, AS-IS, for prioritization only.
Mitigations
Vendor advisory: cve@mitre.org — http://diff.kasseler-cms.net/svn/patches/1232.html
Application impact
| Vendor | Product | Versions | Fixed |
|---|---|---|---|
| kasseler-cms | kasseler-cms | {"endIncluding":"2"} | |
References
- http://diff.kasseler-cms.net/svn.html
- http://diff.kasseler-cms.net/svn/patches/1232.html
- http://osvdb.org/94780
- http://packetstormsecurity.com/files/122282/Kasseler-CMS-2-r1223-CSRF-XSS-SQL-Injection.html
- http://seclists.org/bugtraq/2013/Jul/26
- https://exchange.xforce.ibmcloud.com/vulnerabilities/85408
- https://www.htbridge.com/advisory/HTB23158
- http://diff.kasseler-cms.net/svn.html
- http://diff.kasseler-cms.net/svn/patches/1232.html
- http://osvdb.org/94780
- http://packetstormsecurity.com/files/122282/Kasseler-CMS-2-r1223-CSRF-XSS-SQL-Injection.html
- http://seclists.org/bugtraq/2013/Jul/26
- https://exchange.xforce.ibmcloud.com/vulnerabilities/85408
- https://www.htbridge.com/advisory/HTB23158
CWEs
CWE-79
Verify integrity in audit chain (admin only). AS-IS.