Cross-Site Scripting Vulnerability in b3log Symphony by b3log
CVE-2019-17488

6.1MEDIUM

Key Information:

Vendor

B3log

Status
Symphony
Vendor
CVE Published:
10 October 2019

What is CVE-2019-17488?

The b3log Symphony application versions earlier than 3.6.0 are vulnerable to a Cross-Site Scripting (XSS) attack via the manipulation of the HTTP User-Agent header. This vulnerability allows attackers to inject malicious scripts into web pages viewed by users, compromising user data and potentially leading to session hijacking. It’s essential for users of affected versions to upgrade to version 3.6.0 or later to mitigate this security risk.

References

https://github.com/b3log/symphony/issues/970
x_refsource_MISC

CVSS V3.1

Score:
6.1
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.