Unscored CVE-2017-15214 EUVD-2017-6674GHSA-qhgc-j667-4fq8

Stored XSS vulnerability in Flyspray 1.0-rc4 before 1.0-rc6 allows an authenticated user to inject JavaScript to gain administrator privile…

Published Oct 10, 2017 · Updated Sep 16, 2024 · Assigned by mitre

Description

Stored XSS vulnerability in Flyspray 1.0-rc4 before 1.0-rc6 allows an authenticated user to inject JavaScript to gain administrator privileges and also to execute JavaScript against other users (including unauthenticated users), via the name, title, or id parameter to plugins/dokuwiki/lib/plugins/changelinks/syntax.php.

References

https://github.com/Flyspray/flyspray/releases/tag/v1.0-rc6
http://openwall.com/lists/oss-security/2017/10/07/1
https://github.com/Flyspray/flyspray/commit/00cfae5661124f9d67ac6733db61b2bfee34dccc