Exponent CMS CVE-2017-8085 Cross Site Scripting Vulnerability

Bugtraq ID:	98043
Class:	Input Validation Error
CVE:	CVE-2017-8085
Remote:	Yes
Local:	No
Published:	Apr 24 2017 12:00AM
Updated:	May 02 2017 01:09AM
Credit:	chengable
Vulnerable:	Exponent Exponent CMS 2.4.1 Exponent Exponent CMS 2.4 Exponent Exponent CMS 2.3.9 Exponent Exponent CMS 2.3.2 Exponent Exponent CMS 2.0.5 Exponent Exponent CMS 2.0.4 Exponent Exponent CMS 2.0 Exponent Exponent CMS 0.96.6 Exponent Exponent CMS 0.96.5 Exponent Exponent CMS 2.4.1 patch4 Exponent Exponent CMS 2.4.0 patch1 Exponent Exponent CMS 2.3.7 Exponent Exponent CMS 2.3.5 Exponent Exponent CMS 2.3.0
Not Vulnerable:	Exponent Exponent CMS 2.4.1 patch5

Exponent CMS CVE-2017-8085 Cross Site Scripting Vulnerability

Exponent CMS is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may let the attacker steal cookie-based authentication credentials and launch other attacks.

Versions prior to Exponent 2.4.1 Patch5 are vulnerable.

Exponent CMS CVE-2017-8085 Cross Site Scripting Vulnerability

Attackers can exploit this issue by enticing an unsuspecting user to follow a malicious URI.

Exponent CMS CVE-2017-8085 Cross Site Scripting Vulnerability

Solution:
Updates are available. Please see the references or vendor advisory for more information.

Exponent CMS CVE-2017-8085 Cross Site Scripting Vulnerability

References:

• Exponent CMS Homepage (Exponent)
  
• Exponent CMS Project Page (SourceForge)
  
• fix possible xss security issue with elFinder (thanks to chengable) (Exponent)
  
• PATCH #5 RELEASED FOR V2.4.1 TO FIX A FEW CRITICAL ISSUES (Exponent)
  
• v2.4.1 Patch #5 (Exponent)