Vulnerability Description
flatCore before 1.5.7 allows XSS by an admin via the acp/acp.php?tn=pages&sub=edit&editpage=1 page_linkname, page_title, page_content, or page_extracontent parameter, or the acp/acp.php?tn=system&sub=sys_pref prefs_pagename, prefs_pagetitle, or prefs_pagesubtitle parameter.
CVSS Score
MEDIUM
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Flatcore | Flatcore | < 1.5.7 |
Related Weaknesses (CWE)
References
- https://lists.openwall.net/full-disclosure/2020/08/07/1ExploitMailing ListThird Party Advisory
- https://sec-consult.com/en/blog/advisories/multiple-vulnerabilities-in-flatcore-ExploitThird Party Advisory
- https://lists.openwall.net/full-disclosure/2020/08/07/1ExploitMailing ListThird Party Advisory
- https://sec-consult.com/en/blog/advisories/multiple-vulnerabilities-in-flatcore-ExploitThird Party Advisory
FAQ
What is CVE-2020-17451?
CVE-2020-17451 is a vulnerability with a CVSS score of 4.8 (MEDIUM). flatCore before 1.5.7 allows XSS by an admin via the acp/acp.php?tn=pages&sub=edit&editpage=1 page_linkname, page_title, page_content, or page_extracontent parameter, or the acp/acp.php?tn=system&sub=...
How severe is CVE-2020-17451?
CVE-2020-17451 has been rated MEDIUM with a CVSS base score of 4.8/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2020-17451?
Check the references section above for vendor advisories and patch information. Affected products include: Flatcore Flatcore.