vulnwire
4.3med

CVE-2017-20033

PHPList Reflected cross site scriting

Published 4 y ago · modified 4 mo ago · JSON

CVSS
4.3
v3.1 · CNA
CISA KEV
No
not known exploited
EPSS
0.8%
percentile 55%
Public exploits
0
none known

A vulnerability classified as problematic has been found in PHPList 3.2.6. This affects an unknown part of the file /lists/admin/. The manipulation of the argument page with the input send\'\";><script>alert(8)</script> leads to cross site scripting (Reflected). It is possible to initiate the attack remotely. Upgrading to version 3.3.1 is able to address this issue. It is recommended to upgrade the affected component.

CISA SSVC assessment

Exploitation
Proof of concept public
Automatable
no
Technical impact
partial
Assessed
18 mo ago

Exploit prediction (EPSS)

0.76% probability of exploitation in the next 30 days, higher than 55% of all scored CVEs.

CVSS scores

Assigned byVersionScoreVector
CNA3.14.3CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
CNA3.14.3CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
NVD3.16.1CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
NVD2.04.3AV:N/AC:M/Au:N/C:N/I:P/A:N

Affected products

  • unspecified PHPList

Classification

Weakness
  • CWE-80 Improper Neutralization of Script-Related HTML Tags in a Web Page
  • CWE-79 Improper Neutralization of Input During Web Page Generation

References

  • seclists.org /fulldisclosure/2017/Mar/46 · x_refsource_MISC, x_transferred
  • vuldb.com /?id.98919 · x_refsource_MISC, x_transferred

Sources

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.