CVE-2016-3971

2016-04-1815:00:00

mitre

www.cve.org

5.3 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

31.0%

JSON

Cross-site scripting (XSS) vulnerability in lucene_search.jsp in dotCMS before 3.5.1 allows remote attackers to inject arbitrary web script or HTML via the query parameter to c/portal/layout.

References

dotcms.com/security/SI-33

seclists.org/fulldisclosure/2016/Apr/37