{"containers": {"cna": {"affected": [{"product": "n/a", "vendor": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}], "descriptions": [{"lang": "en", "value": "Cross-site scripting (XSS) vulnerability in the Users module in Orchard 1.7.3 through 1.8.2 and 1.9.x before 1.9.1 allows remote attackers to inject arbitrary web script or HTML via the username when creating a new user account, which is not properly handled when deleting an account."}], "problemTypes": [{"descriptions": [{"description": "n/a", "lang": "en", "type": "text"}]}], "providerMetadata": {"dateUpdated": "2015-07-14T16:00:00Z", "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre"}, "references": [{"tags": ["x_refsource_MISC"], "url": "http://packetstormsecurity.com/files/132583/Orchard-CMS-1.9.0-1.8.2-1.7.3-Cross-Site-Scripting.html"}, {"name": "20150706 Orchard CMS - Persistent XSS vulnerability", "tags": ["mailing-list", "x_refsource_FULLDISC"], "url": "http://seclists.org/fulldisclosure/2015/Jul/32"}, {"tags": ["x_refsource_MISC"], "url": "https://projectzero.gr/en/2015/07/orchard-persistent-xss-vulnerability/"}, {"tags": ["x_refsource_CONFIRM"], "url": "http://docs.orchardproject.net/Documentation/Patch-20150630"}, {"name": "37533", "tags": ["exploit", "x_refsource_EXPLOIT-DB"], "url": "https://www.exploit-db.com/exploits/37533/"}], "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "cve@mitre.org", "ID": "CVE-2015-5520", "STATE": "PUBLIC"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "n/a", "version": {"version_data": [{"version_value": "n/a"}]}}]}, "vendor_name": "n/a"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "Cross-site scripting (XSS) vulnerability in the Users module in Orchard 1.7.3 through 1.8.2 and 1.9.x before 1.9.1 allows remote attackers to inject arbitrary web script or HTML via the username when creating a new user account, which is not properly handled when deleting an account."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "n/a"}]}]}, "references": {"reference_data": [{"name": "http://packetstormsecurity.com/files/132583/Orchard-CMS-1.9.0-1.8.2-1.7.3-Cross-Site-Scripting.html", "refsource": "MISC", "url": "http://packetstormsecurity.com/files/132583/Orchard-CMS-1.9.0-1.8.2-1.7.3-Cross-Site-Scripting.html"}, {"name": "20150706 Orchard CMS - Persistent XSS vulnerability", "refsource": "FULLDISC", "url": "http://seclists.org/fulldisclosure/2015/Jul/32"}, {"name": "https://projectzero.gr/en/2015/07/orchard-persistent-xss-vulnerability/", "refsource": "MISC", "url": "https://projectzero.gr/en/2015/07/orchard-persistent-xss-vulnerability/"}, {"name": "http://docs.orchardproject.net/Documentation/Patch-20150630", "refsource": "CONFIRM", "url": "http://docs.orchardproject.net/Documentation/Patch-20150630"}, {"name": "37533", "refsource": "EXPLOIT-DB", "url": "https://www.exploit-db.com/exploits/37533/"}]}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-06T06:50:02.967Z"}, "title": "CVE Program Container", "references": [{"tags": ["x_refsource_MISC", "x_transferred"], "url": "http://packetstormsecurity.com/files/132583/Orchard-CMS-1.9.0-1.8.2-1.7.3-Cross-Site-Scripting.html"}, {"name": "20150706 Orchard CMS - Persistent XSS vulnerability", "tags": ["mailing-list", "x_refsource_FULLDISC", "x_transferred"], "url": "http://seclists.org/fulldisclosure/2015/Jul/32"}, {"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://projectzero.gr/en/2015/07/orchard-persistent-xss-vulnerability/"}, {"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "http://docs.orchardproject.net/Documentation/Patch-20150630"}, {"name": "37533", "tags": ["exploit", "x_refsource_EXPLOIT-DB", "x_transferred"], "url": "https://www.exploit-db.com/exploits/37533/"}]}]}, "cveMetadata": {"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "assignerShortName": "mitre", "cveId": "CVE-2015-5520", "datePublished": "2015-07-14T16:00:00Z", "dateReserved": "2015-07-14T00:00:00Z", "dateUpdated": "2024-09-16T18:08:13.975Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:orchardproject:orchard:1.7.3:*:*:*:*:*:*:*", "matchCriteriaId": "6B7F5355-5526-4604-90CB-F1857928AB1D", "vulnerable": true}, {"criteria": "cpe:2.3:a:orchardproject:orchard:1.8:*:*:*:*:*:*:*", "matchCriteriaId": "667C3DDB-2D95-4F02-9895-1C796D85C5EB", "vulnerable": true}, {"criteria": "cpe:2.3:a:orchardproject:orchard:1.8.1:*:*:*:*:*:*:*", "matchCriteriaId": "0E71A861-EA18-40C8-B7B1-8A6115BD57D0", "vulnerable": true}, {"criteria": "cpe:2.3:a:orchardproject:orchard:1.8.2:*:*:*:*:*:*:*", "matchCriteriaId": "7144C561-3CC3-47B2-BCC1-5D0967454942", "vulnerable": true}, {"criteria": "cpe:2.3:a:orchardproject:orchard:1.9:*:*:*:*:*:*:*", "matchCriteriaId": "B2742E7C-826E-4203-9E5F-F366F1A64508", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Cross-site scripting (XSS) vulnerability in the Users module in Orchard 1.7.3 through 1.8.2 and 1.9.x before 1.9.1 allows remote attackers to inject arbitrary web script or HTML via the username when creating a new user account, which is not properly handled when deleting an account."}, {"lang": "es", "value": "Vulnerabilidad de secuencias de comando en el m\u00f3dulo de usuarios de Orchard 1.7.3 hasta 1.8.2 y 1.9.x antes de 1.9.1, permite a un atacante inyectar arbitrariamente secuencias de comandos web o HTML a trav\u00e9s del nombre de usuario cuando se crea una nueva cuenta de usuario, lo cual no es correctamente manejado cuando se elimina una cuenta."}], "id": "CVE-2015-5520", "lastModified": "2025-04-12T10:46:40.837", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "MEDIUM", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "NONE", "baseScore": 4.3, "confidentialityImpact": "NONE", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N", "version": "2.0"}, "exploitabilityScore": 8.6, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": true}]}, "published": "2015-07-14T16:59:06.953", "references": [{"source": "cve@mitre.org", "tags": ["Patch", "Vendor Advisory"], "url": "http://docs.orchardproject.net/Documentation/Patch-20150630"}, {"source": "cve@mitre.org", "tags": ["Exploit"], "url": "http://packetstormsecurity.com/files/132583/Orchard-CMS-1.9.0-1.8.2-1.7.3-Cross-Site-Scripting.html"}, {"source": "cve@mitre.org", "tags": ["Exploit"], "url": "http://seclists.org/fulldisclosure/2015/Jul/32"}, {"source": "cve@mitre.org", "tags": ["Exploit"], "url": "https://projectzero.gr/en/2015/07/orchard-persistent-xss-vulnerability/"}, {"source": "cve@mitre.org", "tags": ["Exploit"], "url": "https://www.exploit-db.com/exploits/37533/"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch", "Vendor Advisory"], "url": "http://docs.orchardproject.net/Documentation/Patch-20150630"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Exploit"], "url": "http://packetstormsecurity.com/files/132583/Orchard-CMS-1.9.0-1.8.2-1.7.3-Cross-Site-Scripting.html"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Exploit"], "url": "http://seclists.org/fulldisclosure/2015/Jul/32"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Exploit"], "url": "https://projectzero.gr/en/2015/07/orchard-persistent-xss-vulnerability/"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Exploit"], "url": "https://www.exploit-db.com/exploits/37533/"}], "sourceIdentifier": "cve@mitre.org", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{}