A vulnerability classified as problematic has been found in PHPList 3.2.6. This affects an unknown part of the file /lists/admin/. The manipulation of the argument page with the input send\'\";><script>alert(8)</script> leads to basic cross site scripting (Reflected). The CWE definition for the vulnerability is CWE-80. The weakness was shared 03/17/2017 by Tim Coen with Curesec Research Team as phplist 3.2.6: XSS as Mailinglist Post (Full-Disclosure). It is possible to read the advisory at seclists.org. This vulnerability is uniquely identified as CVE-2017-20033. It is possible to initiate the attack remotely. Technical details are available. There is no exploit available. The pricing for an exploit might be around USD $0-$5k at the moment. The attack technique deployed by this issue is T1059.007 according to MITRE ATT&CK. It is declared as not defined. We expect the 0-day to have been worth approximately $0-$5k. Upgrading to version 3.3.1 is able to address this issue. It is recommended to upgrade the affected component. A possible mitigation has been published even before and not after the disclosure of the vulnerability.

70 more entries are not shown