Design/Logic Flaw

2017-06-0614:29:00

PRIOn knowledge base

www.prio-n.com

5.9 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

34.6%

JSON

The smarty_self function in modules/module_smarty.php in PivotX 2.3.11 mishandles the URI, allowing XSS via vectors involving quotes in the self Smarty tag.

CPENameOperatorVersion
pivotxeq2.3.11

CPE	Name	Operator	Version
	pivotx	eq	2.3.11

References

sourceforge.net/p/pivot-weblog/code/4487/