CVE-2017-15215 Reflected XSS vulnerability in Shaarli v0.9.1 allows an unauthenticated attacker to inject JavaScript via the searchtags parameter to index.php. If the victim is an administrator, an attacker can (for...
MediumCVSS 6.1
EPSS 1.5%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Reflected XSS vulnerability in Shaarli v0.9.1 allows an unauthenticated attacker to inject JavaScript via the searchtags parameter to index.php. If the victim is an administrator, an attacker can (for example) take over the admin session or change global settings or add/delete links. It is also possible to execute JavaScript against unauthenticated users.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| shaarli project shaarli | = 0.9.1 | No fix listed |
References
- openwall.com mailing-list patch third-party-advisory vdb-entry
- github.com third-party-advisory
- github.com release-notes third-party-advisory
- Debian Security Tracker CVE-2017-15215 vendor-advisory