CVE-2017-5870 ViMbAdmin Cross-site Scripting Vulnerabilities
MediumCVSS 5.4
EPSS 1.0%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Multiple cross-site scripting (XSS) vulnerabilities in ViMbAdmin 3.0.15 allow remote attackers to inject arbitrary web script or HTML via the (1) domain or (2) transport parameter to domain/add; the (3) name parameter to mailbox/add/did/<domain id>; the (4) goto parameter to alias/add/did/<domain id>; or the (5) captchatext parameter to auth/lost-password.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| opensolutions/vimbadmin(Packagist) | <= 3.0.15 | No fix listed |
| opensolutions/vimbadmin(Packagist) | = 3.0.0 | No fix listed |
| opensolutions/vimbadmin(Packagist) | = 3.0.1 | No fix listed |
| opensolutions/vimbadmin(Packagist) | = 3.0.10 | No fix listed |
| opensolutions/vimbadmin(Packagist) | = 3.0.11 | No fix listed |
| opensolutions/vimbadmin(Packagist) | = 3.0.12 | No fix listed |
| opensolutions/vimbadmin(Packagist) | = 3.0.13 | No fix listed |
| opensolutions/vimbadmin(Packagist) | = 3.0.14 | No fix listed |
| opensolutions/vimbadmin(Packagist) | = 3.0.15 | No fix listed |
| opensolutions/vimbadmin(Packagist) | = 3.0.2 | No fix listed |
| opensolutions/vimbadmin(Packagist) | = 3.0.3 | No fix listed |
| opensolutions/vimbadmin(Packagist) | = 3.0.4 | No fix listed |
| opensolutions/vimbadmin(Packagist) | = 3.0.5 | No fix listed |
| opensolutions/vimbadmin(Packagist) | = 3.0.6 | No fix listed |
| opensolutions/vimbadmin(Packagist) | = 3.0.7 | No fix listed |
| opensolutions/vimbadmin(Packagist) | = 3.0.8 | No fix listed |
| opensolutions/vimbadmin(Packagist) | = 3.0.9 | No fix listed |
| vimbadmin | = 3.0.15 | No fix listed |
References
- nvd.nist.gov third-party-advisory vendor-advisory
- github.com product
- web.archive.org
- [oss-security] 20170503 [CVE-2017-5870] Multiple XSS vulnerabilities in ViMbAdmin exploit mailing-list third-party-advisory
- github.com
- sysdream.com exploit third-party-advisory