XSS in Dro.pm Project
CVE-2019-25105
A vulnerability, which was classified as problematic, was found in dro.pm. This affects an unknown part of the file web/fileman.php. The manipulation of the argument secret/key leads to cross site scripting. It is possible to initiate the attack remotely. This product does not use versioning. This is why information about affected and unaffected releases are unavailable. The patch is named fa73c3a42bc5c246a1b8f815699ea241aef154bb. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-221763.
Vulnerability class: XSS (Cross-Site Scripting)
Published · last modified .
CVSS v3 metric
CVSS v3 base score 3.5 (Low). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N.
EPSS exploit prediction
EPSS: 0.005 (39.3th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 39th percentile — 39.3% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.005 · newest: 0.005 · change: 0.000
Affected products
- Dro.pm Project
- Dro.pm
Weakness classification (CWE)
References
- vuldb.com/ (technical-description, Third Party Advisory, vdb-entry)
- vuldb.com/ (signature, Permissions Required, permissions-required, Third Party Advisory)
- github.com/lgommans/dro.pm/commit/fa73c3a42bc5c246a1b8f815699ea241aef154bb (Patch, patch)
Frequently asked questions
- What is CVE-2019-25105?
- CVE-2019-25105 is a low-severity vulnerability in Dro.pm Project, classified under Cross-site Scripting. CVSS score: 3.5/10. Published 2023-02-26.
- How severe is CVE-2019-25105?
- Low severity. CVSS v3 base score is 3.5 out of 10.