CVE-2017-5963
published 2017-02-12CVE-2017-5963: An issue was discovered in caddy (for TYPO3) before 7.2.10. The vulnerability exists due to insufficient filtration of user-supplied data in the "paymillToken"…
PriorityP276medium6.1CVSS 3.0
AVNACLPRNUIRSCCLILAN
ITWVulnCheck KEV
Exploited in the wild
EPSS
1.03%
59.3th percentile
An issue was discovered in caddy (for TYPO3) before 7.2.10. The vulnerability exists due to insufficient filtration of user-supplied data in the "paymillToken" HTTP POST parameter passed to the "caddy/Resources/Public/JavaScript/e-payment/paymill/api/php/payment.php" URL. An attacker could execute arbitrary HTML and script code in a browser in the context of the vulnerable website.
Affected
22 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| caddy_project | caddy | — | — |
| caddy_project | caddy | — | — |
| caddy_project | caddy | — | — |
| caddy_project | caddy | — | — |
| caddy_project | caddy | — | — |
| caddy_project | caddy | — | — |
| caddy_project | caddy | — | — |
| caddy_project | caddy | — | — |
| caddy_project | caddy | — | — |
| caddy_project | caddy | — | — |
| caddy_project | caddy | — | — |
| caddy_project | caddy | — | — |
| caddy_project | caddy | — | — |
| caddy_project | caddy | — | — |
| caddy_project | caddy | — | — |
| caddy_project | caddy | — | — |
| caddy_project | caddy | — | — |
| caddy_project | caddy | — | — |
| caddy_project | caddy | — | — |
| caddy_project | caddy | — | — |
| caddy_project | caddy | — | — |
| caddy_project | caddy | — | — |
CVSS provenance
nvdv3.06.1MEDIUMCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
nvdv2.04.3MEDIUMAV:N/AC:M/Au:N/C:N/I:P/A:N
vulncheck6.1MEDIUM
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-8c25-g8jq-vfpw: An issue was discovered in caddy (for TYPO3) before 7
ghsa_unreviewed·2022-05-14
CVE-2017-5963 [MEDIUM] CWE-79 GHSA-8c25-g8jq-vfpw: An issue was discovered in caddy (for TYPO3) before 7
An issue was discovered in caddy (for TYPO3) before 7.2.10. The vulnerability exists due to insufficient filtration of user-supplied data in the "paymillToken" HTTP POST parameter passed to the "caddy/Resources/Public/JavaScript/e-payment/paymill/api/php/payment.php" URL. An attacker could execute arbitrary HTML and script code in a browser in the context of the vulnerable website.
VulnCheck
caddy_project caddy Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
vulncheck·2017·CVSS 6.1
CVE-2017-5963 [MEDIUM] caddy_project caddy Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
caddy_project caddy Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
An issue was discovered in caddy (for TYPO3) before 7.2.10. The vulnerability exists due to insufficient filtration of user-supplied data in the "paymillToken" HTTP POST parameter passed to the "caddy/Resources/Public/JavaScript/e-payment/paymill/api/php/payment.php" URL. An attacker could execute arbitrary HTML and script code in a browser in the context of the vulnerable website.
Affected: caddy_project caddy
Required Action: Apply remediations or mitigations per vendor instructions or discontinue use of the product if remediation or mitigations are unavailable.
Exploitation References: https://www.ic3.gov/Media/News/2022/220126.pdf
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2017-02-12
Published
Exploited in the wild