CVE-2015-5520 Cross-site scripting (XSS) vulnerability in the Users module in Orchard 1.7.3 through 1.8.2 and 1.9.x before 1.9.1 allows remote attackers to inject arbitrary web script or HTML via the username when....
MediumCVSS 4.3
EPSS 4.0%
Public exploit
- Published
- Updated
- Exploit status
- Public exploit available
Description
Cross-site scripting (XSS) vulnerability in the Users module in Orchard 1.7.3 through 1.8.2 and 1.9.x before 1.9.1 allows remote attackers to inject arbitrary web script or HTML via the username when creating a new user account, which is not properly handled when deleting an account.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| orchardproject orchard | = 1.7.3 | No fix listed |
| orchardproject orchard | = 1.8 | No fix listed |
| orchardproject orchard | = 1.8.1 | No fix listed |
| orchardproject orchard | = 1.8.2 | No fix listed |
| orchardproject orchard | = 1.9 | No fix listed |
References
- docs.orchardproject.net patch vendor-advisory
- packetstormsecurity.com exploit
- 20150706 Orchard CMS - Persistent XSS vulnerability exploit mailing-list
- projectzero.gr exploit
- 37533 exploit