CVE-2015-4699 Cross-site scripting (XSS) vulnerability in the Splash Portal in Cloud4Wi before 5.9.7 allows remote attackers to inject arbitrary web script or HTML via the recoveryMessage parameter to the default U...
MediumCVSS 6.1
EPSS 1.8%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Cross-site scripting (XSS) vulnerability in the Splash Portal in Cloud4Wi before 5.9.7 allows remote attackers to inject arbitrary web script or HTML via the recoveryMessage parameter to the default URI.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| cloud4wi splash portal | = 5.9.6 | No fix listed |
References
- 20151211 CLOUD4WI SPLASH PORTAL REFLECTED XSS VULNERABILITY CVE-2015-4699 mailing-list third-party-advisory vdb-entry
- www.quantumleap.it exploit third-party-advisory
- cloud4wi.zendesk.com release-notes third-party-advisory