CVE-2018-17830

The $args variable in addons/mediapool/pages/index.php in REDAXO 5.6.2 is not effectively filtered, because names are not restricted (only values are...

原文の説明

取得元が公開している説明をそのまま載せています (多くは英語)。

The $args variable in addons/mediapool/pages/index.php in REDAXO 5.6.2 is not effectively filtered, because names are not restricted (only values are restricted). The attacker can insert XSS payloads via an index.php?page=mediapool/media&opener_input_field=&args[ substring.

出典: OSV.dev (Open Source Vulnerabilities) NVD OSV

参照URL

report github.com