CVE-2017-12139

2017-08-0205:29:00

Google

osv.dev

5.8 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

25.4%

XOOPS Core 2.5.8 has stored XSS in imagemanager.php because of missing MIME type validation in htdocs/class/uploader.php.

CPENameOperatorVersion
xoopscore25eq2.5.8
xoopscore25eq2.5.8-RC2
xoopscore25eq2.5.8-RC1
xoopscore25eq2.5.8-RC3

Name	Operator	Version
xoopscore25	eq	2.5.8
xoopscore25	eq	2.5.8-RC2
xoopscore25	eq	2.5.8-RC1
xoopscore25	eq	2.5.8-RC3

References

www.securityfocus.com/bid/100094

github.com/XOOPS/XoopsCore25/issues/524