Mail.Ru Calendar Plugin up to 2.5.0.60 on Jira Create Calender month Name cross site scripting

Summaryinfo

A vulnerability labeled as problematic has been found in Mail.Ru Calendar Plugin up to 2.5.0.60 on Jira. This impacts an unknown function of the file MailRuCalendar.jspa#period/month of the component Create Calender. The manipulation of the argument Name results in cross site scripting. This vulnerability is cataloged as CVE-2016-10716. The attack may be launched remotely. There is no exploit available. The affected component should be upgraded.

Detailsinfo

A vulnerability was found in Mail.Ru Calendar Plugin up to 2.5.0.60 on Jira (Calendar Software). It has been classified as problematic. Affected is an unknown part of the file MailRuCalendar.jspa#period/month of the component Create Calender. The manipulation of the argument Name with an unknown input leads to a cross site scripting vulnerability. CWE is classifying the issue as CWE-79. The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users. This is going to have an impact on integrity. CVE summarizes:

The Mail.ru Calendar plugin before 2.5.0.61 for Atlassian Jira has XSS via the Name field in a Create Calender action, related to a MailRuCalendar.jspa#period/month URI.

The bug was discovered 05/04/2016. The weakness was shared 03/16/2018 (Website). The advisory is shared for download at marketplace.atlassian.com. This vulnerability is traded as CVE-2016-10716 since 03/16/2018. It is possible to launch the attack remotely. A authentication is necessary for exploitation. Successful exploitation requires user interaction by the victim. There are known technical details, but no exploit is available. The MITRE ATT&CK project declares the attack technique as T1059.007.

The vulnerability was handled as a non-public zero-day exploit for at least 681 days. During that time the estimated underground price was around $0-$5k.

Upgrading to version 2.5.0.61 eliminates this vulnerability.

Once again VulDB remains the best source for vulnerability data.

Productinfo

Type

• Calendar Software

Vendor

• Mail.Ru

Name

• Calendar Plugin

Version

• 2.5.0.0
• 2.5.0.1
• 2.5.0.2
• 2.5.0.3
• 2.5.0.4
• 2.5.0.5
• 2.5.0.6
• 2.5.0.7
• 2.5.0.8
• 2.5.0.9
• 2.5.0.10
• 2.5.0.11
• 2.5.0.12
• 2.5.0.13
• 2.5.0.14
• 2.5.0.15
• 2.5.0.16
• 2.5.0.17
• 2.5.0.18
• 2.5.0.19
• 2.5.0.20
• 2.5.0.21
• 2.5.0.22
• 2.5.0.23
• 2.5.0.24
• 2.5.0.25
• 2.5.0.26
• 2.5.0.27
• 2.5.0.28
• 2.5.0.29
• 2.5.0.30
• 2.5.0.31
• 2.5.0.32
• 2.5.0.33
• 2.5.0.34
• 2.5.0.35
• 2.5.0.36
• 2.5.0.37
• 2.5.0.38
• 2.5.0.39
• 2.5.0.40
• 2.5.0.41
• 2.5.0.42
• 2.5.0.43
• 2.5.0.44
• 2.5.0.45
• 2.5.0.46
• 2.5.0.47
• 2.5.0.48
• 2.5.0.49
• 2.5.0.50
• 2.5.0.51
• 2.5.0.52
• 2.5.0.53
• 2.5.0.54
• 2.5.0.55
• 2.5.0.56
• 2.5.0.57
• 2.5.0.58
• 2.5.0.59
• 2.5.0.60

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion