Vulnerability Description
Stored XSS vulnerability via a comment in inc/conv.php in BlogoText before 3.7.6 allows an unauthenticated attacker to inject JavaScript. If the victim is an administrator, an attacker can (for example) change global settings or create/delete posts. It is also possible to execute JavaScript against unauthenticated users of the blog.
CVSS Score
MEDIUM
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Blogotext Project | Blogotext | <= 3.7.5 |
Related Weaknesses (CWE)
References
- http://openwall.com/lists/oss-security/2017/10/01/1Mailing ListPatchThird Party Advisory
- https://github.com/BlogoText/blogotext/issues/318Issue TrackingPatchThird Party Advisory
- https://github.com/BlogoText/blogotext/pull/320/commits/1a283cc8ad2cda37e0a6aff8Issue TrackingPatchThird Party Advisory
- https://github.com/BlogoText/blogotext/releases/tag/3.7.6PatchRelease NotesThird Party Advisory
- http://openwall.com/lists/oss-security/2017/10/01/1Mailing ListPatchThird Party Advisory
- https://github.com/BlogoText/blogotext/issues/318Issue TrackingPatchThird Party Advisory
- https://github.com/BlogoText/blogotext/pull/320/commits/1a283cc8ad2cda37e0a6aff8Issue TrackingPatchThird Party Advisory
- https://github.com/BlogoText/blogotext/releases/tag/3.7.6PatchRelease NotesThird Party Advisory
FAQ
What is CVE-2017-14957?
CVE-2017-14957 is a vulnerability with a CVSS score of 6.1 (MEDIUM). Stored XSS vulnerability via a comment in inc/conv.php in BlogoText before 3.7.6 allows an unauthenticated attacker to inject JavaScript. If the victim is an administrator, an attacker can (for exampl...
How severe is CVE-2017-14957?
CVE-2017-14957 has been rated MEDIUM with a CVSS base score of 6.1/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2017-14957?
Check the references section above for vendor advisories and patch information. Affected products include: Blogotext Project Blogotext.