Cross-Site Scripting Vulnerability in Symphony by B3log
CVE-2018-16249

4.8MEDIUM

Key Information:

Vendor

B3log

Status
Symphony
Vendor
CVE Published:
20 June 2019

What is CVE-2018-16249?

A cross-site scripting vulnerability exists in Symphony versions prior to 3.3.0. This issue arises from the way the application handles the 'articleTitle' JSON field, allowing an admin-authenticated user to insert malicious web scripts or HTML payloads. When accessing the /member/test/points URI, the payload can be executed, potentially compromising the security of users interacting with the affected Symphony instance. It is crucial for users to upgrade to a safe version to mitigate this risk.

References

https://github.com/b3log/symphony/issues/729
x_refsource_MISC

CVSS V3.1

Score:
4.8
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
High
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.