Unrated severityNVD Advisory· Published Jun 20, 2019· Updated Aug 5, 2024
CVE-2018-16249
CVE-2018-16249
Description
In Symphony before 3.3.0, there is XSS in the Title under Post. The ID "articleTitle" of this is stored in the "articleTitle" JSON field, and executes a payload when accessing the /member/test/points URI, allowing remote attacks. Any Web script or HTML can be inserted by an admin-authenticated user via a crafted web site name.
Affected products
2- Symphony/Symphonydescription
- Range: <3.3.0
Patches
Vulnerability mechanics
References
1- github.com/b3log/symphony/issues/729mitrex_refsource_MISC
News mentions
0No linked articles in our index yet.