NVD

Id
82270  
Name
CVE-2017-5990  
Description
An issue was discovered in PhreeBooksERP before 2017-02-13. The vulnerability exists due to insufficient filtration of user-supplied data in the form HTTP GET parameter passed to the PhreeBooksERP-master/extensions/ShippingMethods/ups/label_mgr/js_include.php and PhreeBooksERP-master/extensions/ShippingMethods/yrc/label_mgr/js_include.php URLs. An attacker could execute arbitrary HTML and script code in a browser in the context of the vulnerable website. NOTE: these js_include.php files do not exist in the SourceForge stable release (aka R37RC1).  
Reject
 
CVSS Version
2  
CVSS Score
4.3  
Severity
Medium  
CVSS Base Score
4.3  
CVSS Impact Subscore
2.9  
CVSS Exploit Subscore
8.6  
CVSS Vector
(AV:N/AC:M/Au:N/C:N/I:P/A:N)  
Pub Date
2017-03-18  
Published
2017-02-15  
Modified Date
2017-03-01  
Seq
2017-5990  

Actions

Related NVD References

Id NVD Id NVD No. Reference Actions
406810 82270 CVE-2017-2984 https://helpx.adobe.com/security/products/flash-player/apsb17-04.html  View
406811 82270 CVE-2017-2984 https://helpx.adobe.com/security/products/flash-player/apsb17-04.html  View

Related JVN

Id Name Title Summary Cveinfo Name Cveinfo Id Nvdinfo Name Nvdinfo Id Cvssv2 Cvssv3 Jvnurl Published Date Last Updated Date Actions
65384 JVNDB-2017-001747 PhreeBooksERP における任意の HTML およびスクリプトコードを実行される脆弱性 PhreeBooksERP には、任意の HTML およびスクリプトコードを実行される脆弱性が存在します。 CVE-2017-5990 CVE-2017-5990 82270 4.3 6.1 http://jvndb.jvn.jp/ja/contents/2017/JVNDB-2017-001747.html 2017-02-14 2017-03-16 View