CVE-2017-18176

2022-10-0316:23:15

mitre

www.cve.org

progress sitefinity

xss

file upload

javascript

html

same origin

application code

cve-2017-18176

fixed

0.001 Low

EPSS

Percentile

34.6%

JSON

Progress Sitefinity 9.1 has XSS via file upload, because JavaScript code in an HTML file has the same origin as the application’s own code. This is fixed in 10.1.

References

packetstormsecurity.com/files/143894/Progress-Sitefinity-9.1-XSS-Session-Management-Open-Redirect.html

www.sec-consult.com/en/blog/advisories/multiple-vulnerabilities-in-progress-sitefinity/index.html

0.001 Low

EPSS

Percentile

34.6%

JSON

Related for CVELIST:CVE-2017-18176