Is CVE-2015-8684 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2015-8684 being exploited in the wild.

How severe is CVE-2015-8684?

Medium severity, with a CVSS score of 6.1, published 18 January 2017.

Which products and versions are affected?

Exponent CMS Exponent CMS before 2.3.7.

Is there a fix for CVE-2015-8684?

A patch was published on 2015-12-26: Fix committed to GitHub repository Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2015-8684 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2015-8684?

Check whether you run Exponentcms Exponent Cms. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2015-8684: Exponent CMS XSS via arbitrary file upload in elFinder

CVE-2015-8684 · Severity: medium · CVSS 6.1 · Published 2017-01-18

Exponent CMS, a content management system used for building and managing websites, contains a security flaw in its file upload system. An attacker can upload malicious HTML files that, when accessed by other users or administrators, execute unauthorized scripts in their browser. This could lead to the theft of login sessions, unauthorized website changes, or the compromise of user accounts.

Technologies: Exponentcms Exponent Cms. Vendors: Exponentcms.

Quick answers

Is CVE-2015-8684 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2015-8684 being exploited in the wild.
How severe is CVE-2015-8684?: Medium severity, with a CVSS score of 6.1, published 18 January 2017.
Which products and versions are affected?: Exponent CMS Exponent CMS before 2.3.7.
Is there a fix for CVE-2015-8684?: A patch was published on 2015-12-26: Fix committed to GitHub repository Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2015-8684 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2015-8684?: Check whether you run Exponentcms Exponent Cms. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

Exponent CMS versions prior to 2.3.7 are vulnerable to stored cross-site scripting (XSS) due to insufficient file type validation in the elFinder file management component. A remote attacker can upload a file with an .html extension containing malicious JavaScript. When a user or administrator subsequently accesses or previews this file through the elFinder interface, the script executes within the context of the victim's browser session. This can be used to hijack sessions or perform actions on behalf of the authenticated user. The issue was addressed in version 2.3.7 by strengthening server security parameters for upload folders and restricting how elFinder opens files.

Affected products

Exponent CMS Exponent CMS before 2.3.7

Timeline

2015-12-25: disclosed: Vulnerability reported to vendor by Sachin Wagh
2015-12-26: patched: Fix committed to GitHub repository
2017-01-18: advisory: NVD publication date

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.