6.1med
CVE-2017-20239
MDwiki Cross-Site Scripting via Location Hash Parameter
Published 6 mo ago · modified 36 d ago · JSON
CVSS
6.1
v3.1 · CNA
CISA KEV
No
not known exploited
EPSS
0.3%
percentile 19%
Public exploits
0
none known
Summary
MDwiki contains a cross-site scripting vulnerability that allows remote attackers to execute arbitrary JavaScript by injecting malicious code through the location hash parameter. Attackers can craft URLs with JavaScript payloads in the hash fragment that are parsed and rendered without sanitization, causing the injected scripts to execute in the victim's browser context.
CISA SSVC assessment
- Exploitation
- Proof of concept public
- Automatable
- no
- Technical impact
- partial
- Assessed
- 6 mo ago
Exploit prediction (EPSS)
0.27% probability of exploitation in the next 30 days, higher than 19% of all scored CVEs.
CVSS scores
| Assigned by | Version | Score | Vector |
|---|---|---|---|
| CNA | 4.0 | 5.1 | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N |
| CNA | 3.1 | 6.1 | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N |
| CNA | 4.0 | 5.1 | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
| CNA | 3.1 | 6.1 | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N |
Affected products
- Dynalon MDwiki
Classification
- Weakness
- CWE-79 Improper Neutralization of Input During Web Page Generation
References
- exploit-db.com /exploits/46097 · exploit
- vulncheck.com /advisories/mdwiki-cross-site-scripting-via-location-hash-parameter · third-party-advisory
Sources
- CVE List: CVE-2017-20239
- NVD: CVE-2017-20239
vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.