CVE-2017-10667
Vulnerability from cvelistv5
Published
2017-06-29 00:00
Modified
2024-09-17 00:11
Severity ?
Summary
In index.php in Zen Cart 1.6.0, the products_id parameter can cause XSS.
References
cve@mitre.orghttps://github.com/zencart/zencart/issues/1443Issue Tracking, Third Party Advisory
cve@mitre.orghttps://github.com/zhonghaozhao/zencart/issues/1Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108https://github.com/zencart/zencart/issues/1443Issue Tracking, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108https://github.com/zhonghaozhao/zencart/issues/1Third Party Advisory
Impacted products
Vendor Product Version
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-05T17:41:55.680Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/zencart/zencart/issues/1443"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/zhonghaozhao/zencart/issues/1"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In index.php in Zen Cart 1.6.0, the products_id parameter can cause XSS."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2017-06-29T00:00:00Z",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/zencart/zencart/issues/1443"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/zhonghaozhao/zencart/issues/1"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2017-10667",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "In index.php in Zen Cart 1.6.0, the products_id parameter can cause XSS."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://github.com/zencart/zencart/issues/1443",
              "refsource": "MISC",
              "url": "https://github.com/zencart/zencart/issues/1443"
            },
            {
              "name": "https://github.com/zhonghaozhao/zencart/issues/1",
              "refsource": "MISC",
              "url": "https://github.com/zhonghaozhao/zencart/issues/1"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2017-10667",
    "datePublished": "2017-06-29T00:00:00Z",
    "dateReserved": "2017-06-28T00:00:00Z",
    "dateUpdated": "2024-09-17T00:11:08.330Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "fkie_nvd": {
      "configurations": "[{\"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:zen-cart:zen_cart:1.6.0:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"06A476EF-01B0-4A75-BAFE-944B37B48F9E\"}]}]}]",
      "descriptions": "[{\"lang\": \"en\", \"value\": \"In index.php in Zen Cart 1.6.0, the products_id parameter can cause XSS.\"}, {\"lang\": \"es\", \"value\": \"En index.php en Zen Cart 1.6.0, el par\\u00e1metro products_id puede provocar Cross-Site Scripting (XSS). RSA Via Lifecycle and Governance versi\\u00f3n 7.0, en todos los niveles de parches y RSA Identity Management and Governance (RSA IMG) versiones 6.9.1, en todos los niveles de parches, permiten que un administrador de aplicaci\\u00f3n suba archivos arbitrarios que podr\\u00edan contener c\\u00f3digo malicioso. El archivo malicioso podr\\u00eda ejecutarse en el sistema afectado con los privilegios del usuario que est\\u00e1 ejecutando la aplicaci\\u00f3n.\"}]",
      "id": "CVE-2017-10667",
      "lastModified": "2024-11-21T03:06:15.260",
      "metrics": "{\"cvssMetricV30\": [{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"cvssData\": {\"version\": \"3.0\", \"vectorString\": \"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N\", \"baseScore\": 6.1, \"baseSeverity\": \"MEDIUM\", \"attackVector\": \"NETWORK\", \"attackComplexity\": \"LOW\", \"privilegesRequired\": \"NONE\", \"userInteraction\": \"REQUIRED\", \"scope\": \"CHANGED\", \"confidentialityImpact\": \"LOW\", \"integrityImpact\": \"LOW\", \"availabilityImpact\": \"NONE\"}, \"exploitabilityScore\": 2.8, \"impactScore\": 2.7}], \"cvssMetricV2\": [{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"cvssData\": {\"version\": \"2.0\", \"vectorString\": \"AV:N/AC:M/Au:N/C:N/I:P/A:N\", \"baseScore\": 4.3, \"accessVector\": \"NETWORK\", \"accessComplexity\": \"MEDIUM\", \"authentication\": \"NONE\", \"confidentialityImpact\": \"NONE\", \"integrityImpact\": \"PARTIAL\", \"availabilityImpact\": \"NONE\"}, \"baseSeverity\": \"MEDIUM\", \"exploitabilityScore\": 8.6, \"impactScore\": 2.9, \"acInsufInfo\": false, \"obtainAllPrivilege\": false, \"obtainUserPrivilege\": false, \"obtainOtherPrivilege\": false, \"userInteractionRequired\": true}]}",
      "published": "2017-06-29T00:29:00.263",
      "references": "[{\"url\": \"https://github.com/zencart/zencart/issues/1443\", \"source\": \"cve@mitre.org\", \"tags\": [\"Issue Tracking\", \"Third Party Advisory\"]}, {\"url\": \"https://github.com/zhonghaozhao/zencart/issues/1\", \"source\": \"cve@mitre.org\", \"tags\": [\"Third Party Advisory\"]}, {\"url\": \"https://github.com/zencart/zencart/issues/1443\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Issue Tracking\", \"Third Party Advisory\"]}, {\"url\": \"https://github.com/zhonghaozhao/zencart/issues/1\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Third Party Advisory\"]}]",
      "sourceIdentifier": "cve@mitre.org",
      "vulnStatus": "Modified",
      "weaknesses": "[{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"description\": [{\"lang\": \"en\", \"value\": \"CWE-79\"}]}]"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2017-10667\",\"sourceIdentifier\":\"cve@mitre.org\",\"published\":\"2017-06-29T00:29:00.263\",\"lastModified\":\"2024-11-21T03:06:15.260\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In index.php in Zen Cart 1.6.0, the products_id parameter can cause XSS.\"},{\"lang\":\"es\",\"value\":\"En index.php en Zen Cart 1.6.0, el par\u00e1metro products_id puede provocar Cross-Site Scripting (XSS). RSA Via Lifecycle and Governance versi\u00f3n 7.0, en todos los niveles de parches y RSA Identity Management and Governance (RSA IMG) versiones 6.9.1, en todos los niveles de parches, permiten que un administrador de aplicaci\u00f3n suba archivos arbitrarios que podr\u00edan contener c\u00f3digo malicioso. El archivo malicioso podr\u00eda ejecutarse en el sistema afectado con los privilegios del usuario que est\u00e1 ejecutando la aplicaci\u00f3n.\"}],\"metrics\":{\"cvssMetricV30\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.0\",\"vectorString\":\"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N\",\"baseScore\":6.1,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"REQUIRED\",\"scope\":\"CHANGED\",\"confidentialityImpact\":\"LOW\",\"integrityImpact\":\"LOW\",\"availabilityImpact\":\"NONE\"},\"exploitabilityScore\":2.8,\"impactScore\":2.7}],\"cvssMetricV2\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"2.0\",\"vectorString\":\"AV:N/AC:M/Au:N/C:N/I:P/A:N\",\"baseScore\":4.3,\"accessVector\":\"NETWORK\",\"accessComplexity\":\"MEDIUM\",\"authentication\":\"NONE\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"PARTIAL\",\"availabilityImpact\":\"NONE\"},\"baseSeverity\":\"MEDIUM\",\"exploitabilityScore\":8.6,\"impactScore\":2.9,\"acInsufInfo\":false,\"obtainAllPrivilege\":false,\"obtainUserPrivilege\":false,\"obtainOtherPrivilege\":false,\"userInteractionRequired\":true}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-79\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:zen-cart:zen_cart:1.6.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"06A476EF-01B0-4A75-BAFE-944B37B48F9E\"}]}]}],\"references\":[{\"url\":\"https://github.com/zencart/zencart/issues/1443\",\"source\":\"cve@mitre.org\",\"tags\":[\"Issue Tracking\",\"Third Party Advisory\"]},{\"url\":\"https://github.com/zhonghaozhao/zencart/issues/1\",\"source\":\"cve@mitre.org\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://github.com/zencart/zencart/issues/1443\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Issue Tracking\",\"Third Party Advisory\"]},{\"url\":\"https://github.com/zhonghaozhao/zencart/issues/1\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Third Party Advisory\"]}]}}"
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.