CVE-2017-5962 An issue was discovered in contexts_wurfl (for TYPO3) before 0.4.2. The vulnerability exists due to insufficient filtration of user-supplied data in the "force_ua" HTTP GET parameter passed to the "/c...
MediumCVSS 6.1
EPSS 0.76%
- Published
- Updated
- Exploit status
- No public exploit known
Description
An issue was discovered in contexts_wurfl (for TYPO3) before 0.4.2. The vulnerability exists due to insufficient filtration of user-supplied data in the "force_ua" HTTP GET parameter passed to the "/contexts_wurfl/Library/wurfl-dbapi-1.4.4.0/check_wurfl.php" URL. An attacker could execute arbitrary HTML and script code in a browser in the context of the vulnerable website.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| netresearch contexts wurfl | = 0.2.0-alpha | No fix listed |
| netresearch contexts wurfl | = 0.2.1-alpha | No fix listed |
| netresearch contexts wurfl | = 0.2.2-alpha | No fix listed |
| netresearch contexts wurfl | = 0.3.0-alpha | No fix listed |
| netresearch contexts wurfl | = 0.3.1-alpha | No fix listed |
| netresearch contexts wurfl | = 0.4.0-alpha | No fix listed |
| netresearch contexts wurfl | = 0.4.1-alpha | No fix listed |
References
- 96158 third-party-advisory vdb-entry
- forge.typo3.org patch third-party-advisory