VIR Vulnerability Intelligence Relay

CVE-2017-5963

medium
Published 2017-02-12 · Modified 2026-05-13
💬 Discuss on Community ✚ Propose mitigation
CVSS v3
6.1
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CVSS v4 NEW
—
not yet in upstream
VIR risk
6.1

Description

An issue was discovered in caddy (for TYPO3) before 7.2.10. The vulnerability exists due to insufficient filtration of user-supplied data in the "paymillToken" HTTP POST parameter passed to the "caddy/Resources/Public/JavaScript/e-payment/paymill/api/php/payment.php" URL. An attacker could execute arbitrary HTML and script code in a browser in the context of the vulnerable website.

Predictions

Exploit likelihood
71%
Patch ETA
—

Heuristic predictions, AS-IS, for prioritization only.

Mitigations

No mitigations published for this CVE yet.

The vendor-content worker queues fetches as references arrive (check back in a few minutes). Or — if you've already worked around this in production — publish your fix to the community-verified tier.

✚ Propose a mitigation on Community → Mitigations published via the community go through AI scoring + 2 human reviewers + 7-day silent objection window before landing here with source_tier=community-verified.

Application impact
VendorProductVersionsFixed
caddy_projectcaddy2.1.4
caddy_projectcaddy2.1.5
caddy_projectcaddy2.1.6
caddy_projectcaddy3.0.0
caddy_projectcaddy4.0.0
caddy_projectcaddy4.0.1
caddy_projectcaddy4.0.2
caddy_projectcaddy4.0.3
caddy_projectcaddy4.0.12
caddy_projectcaddy6.0.1
caddy_projectcaddy6.0.2
caddy_projectcaddy6.0.9
caddy_projectcaddy6.0.12
caddy_projectcaddy6.0.14
caddy_projectcaddy6.1.0
caddy_projectcaddy6.2.1
caddy_projectcaddy6.3.0
caddy_projectcaddy6.3.1
caddy_projectcaddy6.3.3
caddy_projectcaddy7.0.0
caddy_projectcaddy7.1.0
caddy_projectcaddy7.2.7

References

CWEs

CWE-79

Community-verified mitigations for this CVE will appear above when contributors publish them.

Verify integrity in audit chain (admin only). AS-IS.