CVE-2017-8298 Canvs Canvas Cross-site Scripting (XSS) via title and content fields
MediumCVSS 5.4
EPSS 0.62%
- Published
- Updated
- Exploit status
- No public exploit known
Description
cnvs.io Canvas 3.3.0 has XSS in the title and content fields of a "Posts > Add New" action, and during creation of new tags and users.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| austintoddj/canvas(Packagist) | = 3.3.0 | No fix listed |
| cnvs canvas | = 3.3.0 | No fix listed |
References
- nvd.nist.gov third-party-advisory vendor-advisory
- github.com issue-tracking patch
- github.com product
- github.com