VulnerabilityModified

CVE-2012-1001

Multiple cross-site scripting (XSS) vulnerabilities in Chyrp before 2.1.2 and before 2.5 Beta 2 allow remote attackers to inject arbitrary web script or HTML via the (1) content parameter to includes/ajax.php or (2) body parameter to includes/error.php.

MEDIUM 6.1EPSS 3.56%

Does this matter?

Lower severity and a low EPSS score (3.56%). Track it; it rarely justifies an emergency change on its own.

Description

CVSS 3.1: 6.1 MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
EPSS: 3.56% probability · 89th percentile
CISA KEV: Not listed
Weakness: CWE-79
Affected: chyrp/chyrp
Source: cve@mitre.org

References

http://archives.neohapsis.com/archives/bugtraq/2012-02/0121.htmlBroken Link
http://chyrp.net/2012/02/02/heres-whats-been-going-on-recently/Broken Link
http://www.securityfocus.com/bid/52115Third Party Advisory, VDB Entry
http://www.securityfocus.com/bid/52117Third Party Advisory, VDB Entry
https://github.com/vito/chyrp/commit/f69bd791c37e0b154c0bda16f9759ba19cc77f6cPatch, Third Party Advisory
https://www.htbridge.ch/advisory/HTB23073Exploit, Third Party Advisory
http://archives.neohapsis.com/archives/bugtraq/2012-02/0121.htmlBroken Link
http://chyrp.net/2012/02/02/heres-whats-been-going-on-recently/Broken Link
http://www.securityfocus.com/bid/52115Third Party Advisory, VDB Entry
http://www.securityfocus.com/bid/52117Third Party Advisory, VDB Entry
https://github.com/vito/chyrp/commit/f69bd791c37e0b154c0bda16f9759ba19cc77f6cPatch, Third Party Advisory
https://www.htbridge.ch/advisory/HTB23073Exploit, Third Party Advisory

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.