CVE-2017-1000457 - Cross-site scripting (XSS) vulnerability in Help.aspx in mojoPortal version 2.5.0.0 allows remote attackers to inject arbitrary web script or HTML via the helpkey parameter

Back Back to CVE browser

MEDIUM

Cross-site scripting (XSS) vulnerability in Help.aspx in mojoPortal version 2.5.0.0 allows remote attackers to inject arbitrary web script or HTML via the helpkey parameter

Published Jan 2, 2018

4.8

MEDIUM

CVSS 3.0

EPSS 0.82%

Description

Cross-site scripting (XSS) vulnerability in Help.aspx in mojoPortal version 2.5.0.0 allows remote attackers to inject arbitrary web script or HTML via the helpkey parameter. Exploitation requires authenticated reflected cross-site scripting for user accounts assigned either the "Administrators" or "Content Administrators" role.

Affected products

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-79

Cross-site Scripting (XSS)

References (3)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2017-1584
Advisory
https://github.com/i7MEDIA/mojoportal/commit/5ea8129f74c80cbf1f68b9083c745cc8a685485d
x_refsource_MISCPatch
https://www.mojoportal.com/mojoportal-2-6
x_refsource_MISCRelease Notes

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2017-1584		Advisory
https://github.com/i7MEDIA/mojoportal/commit/5ea8129f74c80cbf1f68b9083c745cc8a685485d		x_refsource_MISCPatch
https://www.mojoportal.com/mojoportal-2-6		x_refsource_MISCRelease Notes