Content Forgery and XSS Vulnerabilities in SocuSoft Flash Slideshow Maker Professional
CVE-2017-12439

7.5HIGH

Key Information:

Vendor

Socusoft

Status
Flash Slideshow Maker
Vendor
CVE Published:
5 August 2017

What is CVE-2017-12439?

SocuSoft Flash Slideshow Maker Professional, specifically versions up to v5.20, exhibits a vulnerability involving an xml_path parameter that improperly trusts user-supplied input. This flaw results from an unsafe XML configuration file and leads to potential content forgery, cross-site scripting (XSS) attacks, and unvalidated redirection. Such vulnerabilities can allow attackers to manipulate web content and redirect users to malicious websites, posing a significant risk to users and their data.

References

https://packetstormsecurity.com/files/143542/Flash-Slides...
x_refsource_MISC

CVSS V3.1

Score:
7.5
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.