What is CVE-2017-15215?

CVE-2017-15215 is a medium-severity vulnerability in Shaarli Project, classified under Cross-site Scripting. CVSS score: 6.1/10. Published 2017-10-11.

How severe is CVE-2017-15215?

Medium severity. CVSS v3 base score is 6.1 out of 10.

XSS in Shaarli Project

CVE-2017-15215

Reflected XSS vulnerability in Shaarli v0.9.1 allows an unauthenticated attacker to inject JavaScript via the searchtags parameter to index.php. If the victim is an administrator, an attacker can (for example) take over the admin session or change global settings or add/delete links. It is also possible to execute JavaScript against unauthenticated users.

Vulnerability class: XSS (Cross-Site Scripting)

EPSS: 0.015 (71.4th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 6.1 (Medium). Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N.

Affected products

Shaarli_project Shaarli — versions 0.9.1
N/a — versions n/a

Weakness classification (CWE)

CWE-79 — Cross-site Scripting

References

cve@mitre.org (Third Party Advisory, x_refsource_MISC)
cve@mitre.org (Patch, Mailing List, VDB Entry, Third Party Advisory, x_refsource_MISC)
cve@mitre.org (Third Party Advisory, x_refsource_MISC, Release Notes)

Frequently asked questions

What is CVE-2017-15215?: CVE-2017-15215 is a medium-severity vulnerability in Shaarli Project, classified under Cross-site Scripting. CVSS score: 6.1/10. Published 2017-10-11.
How severe is CVE-2017-15215?: Medium severity. CVSS v3 base score is 6.1 out of 10.