NVD

Id
86119  
Name
CVE-2017-8898  
Description
Invision Power Services (IPS) Community Suite 4.1.19.2 and earlier has stored XSS in the Announcements, allowing privilege escalation from an Invision Power Board moderator to an admin. An attack uses the announce_content parameter in an index.php?/modcp/announcements/&action=create request. This is related to the <> Source option.  
Reject
 
CVSS Version
2  
CVSS Score
7.5  
Severity
High  
CVSS Base Score
7.5  
CVSS Impact Subscore
6.4  
CVSS Exploit Subscore
10  
CVSS Vector
(AV:N/AC:L/Au:N/C:P/I:P/A:P)  
Pub Date
2017-05-27  
Published
2017-05-11  
Modified Date
2017-05-16  
Seq
2017-8898  

Actions

Related NVD References

Related JVN

Id Name Title Summary Cveinfo Name Cveinfo Id Nvdinfo Name Nvdinfo Id Cvssv2 Cvssv3 Jvnurl Published Date Last Updated Date Actions
67470 JVNDB-2017-003767 Invision Power Services Community Suite における認可・権限・アクセス制御に関する脆弱性 Invision Power Services (IPS) Community Suite には、認可・権限・アクセス制御に関する脆弱性が存在します。 CVE-2017-8898 0 CVE-2017-8898 86119 7.5 9.8 http://jvndb.jvn.jp/ja/contents/2017/JVNDB-2017-003767.html 2017-05-09 2017-06-07 View