CVE-2017-16881

b3log Symphony aka Sym 2.2.0 does not properly address XSS in JSON objects, as demonstrated by a crafted userAvatarURL value to /settings/avatar, related to processor/AdminProcessor.java, processor/ArticleProcessor.java, processor/UserProcessor.java, service/ArticleQueryService.java,...

CVE-2017-16881

b3log Symphony aka Sym 2.2.0 does not properly address XSS in JSON objects, as demonstrated by a crafted userAvatarURL value to /settings/avatar, related to processor/AdminProcessor.java, processor/ArticleProcessor.java, processor/UserProcessor.java, service/ArticleQueryService.java,...

PT-2017-14616

Name of the Vulnerable Software and Affected Versions b3log Symphony aka Sym version 2.2.0 Description The issue is related to improper handling of XSS in JSON objects. Specifically, a crafted userAvatarURL value can be used to exploit this issue, as demonstrated in the /settings/avatar endpoint...