XSS in EasyPublish CMS
Advisory ID: | HTB22356 |
Product: | EasyPublish CMS |
Vendor: | Escio AS |
Vulnerable Versions: | Current on 23.04.2010 and probably prior |
Tested Version: | Current on 23.04.2010 |
Advisory Publication: | April 23, 2010 [without technical details] |
Vendor Notification: | April 23, 2010 |
Public Disclosure: | May 7, 2010 |
Latest Update: | April 29, 2010 |
Vulnerability Type: | Cross-Site Scripting [CWE-79] |
Risk Level: | Medium |
CVSSv2 Base Score: | 4.3 (AV:N/AC:M/Au:N/C:N/I:P/A:N) |
Solution Status: | Fixed by Vendor |
Discovered and Provided: | High-Tech Bridge Security Research Lab |
Advisory Details: | |
High-Tech Bridge SA Security Research Lab has discovered a vulnerability in EasyPublish CMS which could be exploited to perform cross-site scripting (XSS) attacks. | |
Solution: | |
Upgrade to the most recent version | |
References: | |
[1] High-Tech Bridge Advisory HTB22356 - https://www.immuniweb.com/advisory/HTB22356 - XSS in EasyPublish CMS [2] EasyPublish CMS - http://www.easypublish.no - EasyPublish CMS is a special solution designed to solve complex tasks. [3] Common Weakness Enumeration (CWE) - http://cwe.mitre.org - targeted to developers and security practitioners, CWE is a formal list of software weakness types. | |
Please feel free to send us any additional information related to this Advisory, such as vulnerable versions, additional exploitation details and conditions, patches and other relevant details.