CVE-2014-7264
Multiple cross-site scripting (XSS) vulnerabilities in admin/themes/default/pages/manage_users.twig in the Users Management feature in the admin component in Chyrp before 2.5.1 allow remote authenticated users to inject arbitrary web script or HTML via…
Does this matter?
Lower severity and a low EPSS score (1.42%). Track it; it rarely justifies an emergency change on its own.
Description
Multiple cross-site scripting (XSS) vulnerabilities in admin/themes/default/pages/manage_users.twig in the Users Management feature in the admin component in Chyrp before 2.5.1 allow remote authenticated users to inject arbitrary web script or HTML via the (1) user.email or (2) user.website field in a user registration.
- CVSS 2.0
- 3.5 LOWAV:N/AC:M/Au:S/C:N/I:P/A:N
- EPSS
- 1.42% probability · 71th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-79
- Affected
- chyrp/chyrp
- Source
- vultures@jpcert.or.jp
References
- http://chyrp.net/2014/11/18/chyrp-251-security-release/Vendor Advisory
- http://jvn.jp/en/jp/JVN13160869/index.htmlVendor Advisory
- http://jvndb.jvn.jp/jvndb/JVNDB-2014-000149Vendor Advisory
- https://github.com/chyrp/chyrp/commit/43d1b6b266363ae7545d5d49851034eaeec7bebbVendor Advisory
- http://chyrp.net/2014/11/18/chyrp-251-security-release/Vendor Advisory
- http://jvn.jp/en/jp/JVN13160869/index.htmlVendor Advisory
- http://jvndb.jvn.jp/jvndb/JVNDB-2014-000149Vendor Advisory
- https://github.com/chyrp/chyrp/commit/43d1b6b266363ae7545d5d49851034eaeec7bebbVendor Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.