Ecosyste.ms: Advisories

Security Advisories: GSA_kwCzR0hTQS02aHYzLTlmcXgtOHBnNc4AAxPm

CImage Cross-site Scripting vulnerability

A vulnerability was found in mosbth cimage up to 0.7.18. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the file check_system.php. The manipulation of the argument $_SERVER['SERVER_SOFTWARE'] leads to cross site scripting. The attack can be launched remotely. Upgrading to version 0.7.19 is able to address this issue. The name of the patch is 401478c8393989836beeddfeac5ce44570af162b. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-219715.

Permalink: https://github.com/advisories/GHSA-6hv3-9fqx-8pg5
JSON: https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS02aHYzLTlmcXgtOHBnNc4AAxPm
Source: GitHub Advisory Database
Origin: Unspecified
Severity: Moderate
Classification: General
Published: almost 2 years ago
Updated: about 1 year ago

CVSS Score: 6.1
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

EPSS Percentage: 0.00123
EPSS Percentile: 0.47503

Identifiers: GHSA-6hv3-9fqx-8pg5, CVE-2016-15022
References:

• https://nvd.nist.gov/vuln/detail/CVE-2016-15022
• https://github.com/mosbth/cimage/commit/401478c8393989836beeddfeac5ce44570af162b
• https://github.com/mosbth/cimage/releases/tag/v0.7.19
• https://vuldb.com/?ctiid.219715
• https://vuldb.com/?id.219715
• https://github.com/advisories/GHSA-6hv3-9fqx-8pg5

Repository: https://github.com/mosbth/cimage
Blast Radius: 10.3

Affected Packages