XSS Vulnerability in b3log Symphony Admin Console
CVE-2017-16821

5.4MEDIUM

Key Information:

Vendor

B3log

Status
Symphony
Vendor
CVE Published:
15 November 2017

What is CVE-2017-16821?

b3log Symphony 2.2.0 is susceptible to a Cross-Site Scripting (XSS) vulnerability in the admin console, specifically in the AdminProcessor class. An attacker could exploit this issue by sending a specially crafted X-Forwarded-For HTTP header. This crafted header might be mishandled when displayed, allowing for the execution of malicious scripts within the user's browser session, potentially compromising sensitive information.

References

https://github.com/b3log/symphony/issues/503
x_refsource_CONFIRM

CVSS V3.1

Score:
5.4
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability Reserved

  • Vulnerability published

.