A vulnerability, which was classified as problematic, was found in DedeCMS 5.7.116. This affects the function RemoveXSS of the file /plus/carbuyaction.php of the component HTTP POST Request Handler. The manipulation leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
References
| Link | Resource |
|---|---|
| https://github.com/Hebing123/cve/issues/79 | Exploit Third Party Advisory |
| https://vuldb.com/?ctiid.286905 | Permissions Required |
| https://vuldb.com/?id.286905 | Third Party Advisory |
| https://vuldb.com/?submit.453374 | Third Party Advisory |
Configurations
History
10 Dec 2024, 16:05
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://vuldb.com/?submit.453374 - Third Party Advisory | |
| References | () https://vuldb.com/?ctiid.286905 - Permissions Required | |
| References | () https://vuldb.com/?id.286905 - Third Party Advisory | |
| References | () https://github.com/Hebing123/cve/issues/79 - Exploit, Third Party Advisory | |
| CPE | cpe:2.3:a:dedecms:dedecms:*:*:*:*:*:*:*:* | |
| First Time |
Dedecms
Dedecms dedecms |
|
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 5.4 |
| CWE |
04 Dec 2024, 23:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2024-12-04 23:15
Updated : 2024-12-10 16:05
NVD link : CVE-2024-12183
Mitre link : CVE-2024-12183
JSON object : View
Products Affected
dedecms
- dedecms
CWE
CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')