b3log Symphony (aka Sym) 2.2.0 has XSS in processor/AdminProcessor.java in the admin console, as demonstrated by a crafted X-Forwarded-For HTTP header that is mishandled during display of a client IP address in /admin/user/userid.
References
Link | Resource |
---|---|
https://github.com/b3log/symphony/issues/503 | Exploit Issue Tracking Third Party Advisory |
History
No history.
MITRE Information
Status: PUBLISHED
Assigner: mitre
Published: 2022-10-03T16:23:21
Updated: 2022-10-03T16:23:21
Reserved: 2022-10-03T00:00:00
Link: CVE-2017-16821
JSON object: View
NVD Information
Status : Analyzed
Published: 2017-11-15T03:29:02.030
Modified: 2020-07-28T14:38:21.580
Link: CVE-2017-16821
JSON object: View
Redhat Information
No data.
CWE