CVE-2011-4340
published 2012-02-12CVE-2011-4340: Multiple cross-site scripting (XSS) vulnerabilities in Symphony CMS 2.2.3 and possibly other versions before 2.2.4 allow remote authenticated users with Author…
PriorityP413low3.5CVSS 2.0
AVNACMAuSCNIPAN
EXPLOIT
EPSS
1.87%
76.7th percentile
Multiple cross-site scripting (XSS) vulnerabilities in Symphony CMS 2.2.3 and possibly other versions before 2.2.4 allow remote authenticated users with Author privileges to inject arbitrary web script or HTML via (1) the profile parameter to extensions/profiledevkit/content/content.profile.php, as demonstrated via requests to (a) the default URI, (b) about/, or (c) drafts/; or (2) the filter parameter in symphony/lib/core/class.symphony.php, as demonstrated via requests to (d) symphony/publish/comments or (e) symphony/publish/images. NOTE: some of these details are obtained from third party information.
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| symphony-cms | symphony_cms | — | — |
| symphonycms | symphony-2 | >= 0 < 2.2.4 | 2.2.4 |
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
Symphony CMS vulnerable to Cross-site Scripting
osv·2022-05-17
CVE-2011-4340 [LOW] Symphony CMS vulnerable to Cross-site Scripting
Symphony CMS vulnerable to Cross-site Scripting
Multiple cross-site scripting (XSS) vulnerabilities in Symphony CMS 2.2.3 and possibly other versions before 2.2.4 allow remote authenticated users with Author privileges to inject arbitrary web script or HTML via (1) the profile parameter to extensions/profiledevkit/content/content.profile.php, as demonstrated via requests to (a) the default URI, (b) about/, or (c) drafts/; or (2) the filter parameter in symphony/lib/core/class.symphony.php, as demonstrated via requests to (d) symphony/publish/comments or (e) symphony/publish/images. NOTE: some of these details are obtained from third party information.
GHSA
Symphony CMS vulnerable to Cross-site Scripting
ghsa·2022-05-17
CVE-2011-4340 [LOW] CWE-79 Symphony CMS vulnerable to Cross-site Scripting
Symphony CMS vulnerable to Cross-site Scripting
Multiple cross-site scripting (XSS) vulnerabilities in Symphony CMS 2.2.3 and possibly other versions before 2.2.4 allow remote authenticated users with Author privileges to inject arbitrary web script or HTML via (1) the profile parameter to extensions/profiledevkit/content/content.profile.php, as demonstrated via requests to (a) the default URI, (b) about/, or (c) drafts/; or (2) the filter parameter in symphony/lib/core/class.symphony.php, as demonstrated via requests to (d) symphony/publish/comments or (e) symphony/publish/images. NOTE: some of these details are obtained from third party information.
No detection rules found.
No writeups or analysis indexed.
http://packetstormsecurity.org/files/view/106493/symphonycms-sqlxss.txthttp://seclists.org/bugtraq/2011/Nov/8http://secunia.com/advisories/46663http://symphony-cms.com/download/releases/version/2.2.4/http://www.mavitunasecurity.com/xss-and-sql-injection-vulnerabilities-in-symphony-cms/http://www.openwall.com/lists/oss-security/2011/11/22/9http://www.osvdb.org/76882http://www.osvdb.org/76883https://exchange.xforce.ibmcloud.com/vulnerabilities/71106http://packetstormsecurity.org/files/view/106493/symphonycms-sqlxss.txthttp://seclists.org/bugtraq/2011/Nov/8http://secunia.com/advisories/46663http://symphony-cms.com/download/releases/version/2.2.4/http://www.mavitunasecurity.com/xss-and-sql-injection-vulnerabilities-in-symphony-cms/http://www.openwall.com/lists/oss-security/2011/11/22/9http://www.osvdb.org/76882http://www.osvdb.org/76883https://exchange.xforce.ibmcloud.com/vulnerabilities/71106
2012-02-12
Published