CVE-2017-7188 Zurmo 3.1.1 Stable allows a Cross-Site Scripting (XSS) attack with a base64-encoded SCRIPT element within a data: URL in the returnUrl parameter to default/toggleCollapse.
MediumCVSS 5.4
EPSS 1.4%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Zurmo 3.1.1 Stable allows a Cross-Site Scripting (XSS) attack with a base64-encoded SCRIPT element within a data: URL in the returnUrl parameter to default/toggleCollapse.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| zurmo crm | <= 3.1.1 | No fix listed |
References
- 97681 third-party-advisory vdb-entry
- bitbucket.org third-party-advisory
- github.com exploit third-party-advisory