In Symphony before 3.3.0, there is XSS in the Title under Post. The ID "articleTitle" of this is stored in the "articleTitle" JSON field, and executes a payload when accessing the /member/test/points URI, allowing remote attacks. Any Web script or HTML can be inserted by an admin-authenticated user via a crafted web site name.
Metrics
Affected Vendors & Products
References
Link | Providers |
---|---|
https://github.com/b3log/symphony/issues/729 |
History
No history.
MITRE
Status: PUBLISHED
Assigner: mitre
Published: 2019-06-20T13:54:12
Updated: 2024-08-05T10:17:38.305Z
Reserved: 2018-08-30T00:00:00
Link: CVE-2018-16249
Vulnrichment
No data.
NVD
Status : Modified
Published: 2019-06-20T14:15:10.593
Modified: 2024-11-21T03:52:22.407
Link: CVE-2018-16249
Redhat
No data.