CVE-2015-4673
Description
Multiple cross-site scripting (XSS) vulnerabilities in ClipBucket 2.7.0.5 allow remote authenticated users to inject arbitrary web script or HTML via (1) the collection_description parameter to upload/manage_collections.php in an add_new action or the (2) photo_description, (3) photo_tags, or (4) photo_title parameter to upload/actions/photo_uploader.php.
Predictions
Heuristic predictions, AS-IS, for prioritization only.
Mitigations
No mitigations published for this CVE yet.
The vendor-content worker queues fetches as references arrive (check back in a few minutes). Or — if you've already worked around this in production — publish your fix to the community-verified tier.
✚ Propose a mitigation on Community → Mitigations published via the community go through AI scoring + 2 human reviewers + 7-day silent objection window before landing here withsource_tier=community-verified.
Application impact
| Vendor | Product | Versions | Fixed |
|---|---|---|---|
| clip-bucket | clipbucket | 2.7.0.5 | |
References
- http://secpod.org/advisories/SecPod_ClipBucket_Multiple_XSS_Vuln.txt
- http://secpod.org/advisories_cvrf/SecPod_ClipBucket_Multiple_XSS_Vuln.xml
- http://www.secpod.com/blog/clipbucket-2-7-0-5-multiple-stored-cross-site-scripting-vulnerability/
- http://secpod.org/advisories/SecPod_ClipBucket_Multiple_XSS_Vuln.txt
- http://secpod.org/advisories_cvrf/SecPod_ClipBucket_Multiple_XSS_Vuln.xml
- http://www.secpod.com/blog/clipbucket-2-7-0-5-multiple-stored-cross-site-scripting-vulnerability/
CWEs
CWE-79
Community-verified mitigations for this CVE will appear above when contributors publish them.
Verify integrity in audit chain (admin only). AS-IS.