Is CVE-2015-8667 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2015-8667 being exploited in the wild.

How severe is CVE-2015-8667?

Medium severity, with a CVSS score of 6.1, published 18 January 2017.

Which products and versions are affected?

Exponent CMS Exponent CMS before 2.3.5.

Is there a fix for CVE-2015-8667?

A patch was published on 2015-12-24: Fix committed to GitHub repository Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2015-8667 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2015-8667?

Check whether you run Exponentcms Exponent Cms. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2015-8667: Exponent CMS cross-site scripting in Reset Your Password module

CVE-2015-8667 · Severity: medium · CVSS 6.1 · Published 2017-01-18

Exponent CMS, a content management system used for building and managing websites, contains a security flaw in its password reset feature. An attacker can use this vulnerability to inject malicious scripts into the website, which could lead to the theft of user session information or unauthorized actions being performed in a user's browser. This could compromise the accounts of website visitors or administrators who interact with the affected page.

Technologies: Exponentcms Exponent Cms. Vendors: Exponentcms.

Quick answers

Is CVE-2015-8667 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2015-8667 being exploited in the wild.
How severe is CVE-2015-8667?: Medium severity, with a CVSS score of 6.1, published 18 January 2017.
Which products and versions are affected?: Exponent CMS Exponent CMS before 2.3.5.
Is there a fix for CVE-2015-8667?: A patch was published on 2015-12-24: Fix committed to GitHub repository Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2015-8667 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2015-8667?: Check whether you run Exponentcms Exponent Cms. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A reflected cross-site scripting (XSS) vulnerability exists in Exponent CMS versions prior to 2.3.5. The flaw is located within the 'Reset Your Password' module, specifically due to insufficient sanitization of user-supplied input in the 'Username/Email' field. A remote, unauthenticated attacker can exploit this by tricking a user into clicking a specially crafted link, allowing the execution of arbitrary JavaScript or HTML in the context of the victim's browser session. This can result in session hijacking or unauthorized modification of page content. The issue was addressed in version 2.3.6 by implementing improved input sanitization logic.

Affected products

Exponent CMS Exponent CMS before 2.3.5

Timeline

2015-12-24: disclosed: Vulnerability reported by Sachin Wagh
2015-12-24: patched: Fix committed to GitHub repository
2017-01-18: advisory: NVD published the CVE record

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.