CVE-2017-14321
published 2017-09-21CVE-2017-14321: Multiple cross-site scripting (XSS) vulnerabilities in the administrative interface in Mirasvit Helpdesk MX before 1.5.3 allow remote attackers to inject…
PriorityP278medium5.4CVSS 3.0
AVNACLPRLUIRSCCLILAN
ITWVulnCheck KEV
Exploited in the wild
EPSS
0.60%
44.3th percentile
Multiple cross-site scripting (XSS) vulnerabilities in the administrative interface in Mirasvit Helpdesk MX before 1.5.3 allow remote attackers to inject arbitrary web script or HTML via the (1) customer name or (2) subject in a ticket.
Affected
1 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| mirasvit | helpdesk_mx | <= 1.5.2 | — |
CVSS provenance
nvdv3.05.4MEDIUMCVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
nvdv2.03.5LOWAV:N/AC:M/Au:S/C:N/I:P/A:N
vulncheck5.4MEDIUM
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-66xf-hmj3-jj6x: Multiple cross-site scripting (XSS) vulnerabilities in the administrative interface in Mirasvit Helpdesk MX before 1
ghsa_unreviewed·2022-05-17
CVE-2017-14321 [MEDIUM] CWE-79 GHSA-66xf-hmj3-jj6x: Multiple cross-site scripting (XSS) vulnerabilities in the administrative interface in Mirasvit Helpdesk MX before 1
Multiple cross-site scripting (XSS) vulnerabilities in the administrative interface in Mirasvit Helpdesk MX before 1.5.3 allow remote attackers to inject arbitrary web script or HTML via the (1) customer name or (2) subject in a ticket.
VulnCheck
mirasvit helpdesk_mx Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
vulncheck·2017·CVSS 5.4
CVE-2017-14321 [MEDIUM] mirasvit helpdesk_mx Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
mirasvit helpdesk_mx Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Multiple cross-site scripting (XSS) vulnerabilities in the administrative interface in Mirasvit Helpdesk MX before 1.5.3 allow remote attackers to inject arbitrary web script or HTML via the (1) customer name or (2) subject in a ticket.
Affected: mirasvit helpdesk_mx
Required Action: Apply remediations or mitigations per vendor instructions or discontinue use of the product if remediation or mitigations are unavailable.
Exploitation References: https://sansec.io/research/hackers-breach-magento-through-helpdesk
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2017-09-21
Published
Exploited in the wild