CVE-2017-17059

MEDIUMNuclei

WordPress amtyThumb Posts 8.1.3 - Cross-Site Scripting

Title source: github.com
STIX 2.1 vulnerability

Record summary

CVE-2017-17059 has a selected CVSS score of 6.1 (medium); EIP currently links 1 Nuclei template.

Description

XSS exists in the amtyThumb amty-thumb-recent-post (aka amtyThumb posts or wp-thumb-post) plugin 8.1.3 for WordPress via the query string to amtyThumbPostsAdminPg.php.

Description source: CVE List

Exploitation context

Available material

Nuclei templates
1

Nuclei templates

1
ProjectDiscoveryMEDIUMWordPress amtyThumb Posts 8.1.3 - Cross-Site ScriptingCVSS 6.1

WordPress amty-thumb-recent-post plugin 8.1.3 contains a cross-site scripting vulnerability via the query string to amtyThumbPostsAdminPg.php.

Impact

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary JavaScript code in the context of the victim's browser.

Remediation

Update to the latest version of amtyThumb Posts plugin or apply the patch provided by the vendor.

WeaknessesCWE-79
Authorsdaffainfo
Template tagscve2017cvexsswp-pluginpacketstormwordpressamtythumb_projectvuln
CVSS vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CPE: cpe:2.3:a:amtythumb_project:amtythumb:*:*:*:*:*:wordpress:*:*
https://github.com/NaturalIntelligence/wp-thumb-post/issues/1 https://packetstormsecurity.com/files/145044/WordPress-amtyThumb-8.1.3-Cross-Site-Scripting.html https://nvd.nist.gov/vuln/detail/CVE-2017-17059 https://github.com/ARPSyndicate/kenzer-templates

Source: ProjectDiscovery

References

3