vulnwire
5.4med

CVE-2016-20098

Moderator Toolbox before 4.0.14 Stored XSS via Removal Reasons Configuration

Published 28 d ago · modified 28 d ago · JSON

CVSS
5.4
v3.1 · CNA
CISA KEV
No
not known exploited
EPSS
0.2%
percentile 6%
Public exploits
0
none known

Moderator Toolbox (reddit-moderator-toolbox) before 4.0.14 contains a stored cross-site scripting vulnerability in the removalreasons module, which inserts subreddit toolbox wiki fields into popup HTML without encoding. Attackers who can edit the toolbox wiki page can plant JavaScript in fields like pmsubject, header, or reason titles to act with moderators' Reddit sessions.

CISA SSVC assessment

Exploitation
none
Automatable
no
Technical impact
partial
Assessed
28 d ago

Exploit prediction (EPSS)

0.17% probability of exploitation in the next 30 days, higher than 6% of all scored CVEs.

CVSS scores

Assigned byVersionScoreVector
CNA4.05.1CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N
CNA3.15.4CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
CNA4.05.1CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CNA3.15.4CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Affected products

  • toolbox-team reddit-moderator-toolbox

Classification

Weakness
  • CWE-79 Improper Neutralization of Input During Web Page Generation

References

  • github.com /toolbox-team/reddit-moderator-toolbox/commit/26f45ba21d84cecb92b1a820896ad3bf5254376e · patch
  • github.com /toolbox-team/reddit-moderator-toolbox · product
  • vulncheck.com /advisories/moderator-toolbox-before-4.0.14-stored-xss-via-removal-reasons-configuration · third-party-advisory

Sources

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.