Skip to content

CVE-2017-9448 Cross-site scripting (XSS) vulnerabilities in BigTree CMS through 4.2.18 allow remote authenticated users to inject arbitrary web script or HTML via the description parameter. This issue exists in cor...

MediumCVSS 5.4 EPSS 0.59%
Published
Updated
Exploit status
No public exploit known
Sign in for asset impact Search another CVE

Description

Cross-site scripting (XSS) vulnerabilities in BigTree CMS through 4.2.18 allow remote authenticated users to inject arbitrary web script or HTML via the description parameter. This issue exists in core\admin\ajax\pages\save-revision.php and core\admin\modules\pages\revisions.php. Low-privileged (administrator) users can attack high-privileged (Developer) users.

Affected products

ProductAffected versionsFixed in
bigtreecms bigtree cms <= 4.2.18 No fix listed

References

  • github.com issue-tracking patch third-party-advisory