Is CVE-2017-5494 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2017-5494 being exploited in the wild.

How severe is CVE-2017-5494?

Medium severity, with a CVSS score of 5.4, published 15 January 2017.

Which products and versions are affected?

b2evolution b2evolution through 6.8.3.

Is there a fix for CVE-2017-5494?

A patch was published on 2017-01-15: Fix committed to b2evolution repository Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2017-5494 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2017-5494?

Check whether you run B2evolution. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2017-5494: b2evolution stored XSS via malicious SWF upload

CVE-2017-5494 · Severity: medium · CVSS 5.4 · Published 2017-01-15

b2evolution is a content management system used for hosting blogs and websites. A security flaw in how the system handles file uploads allows registered users to upload malicious Flash files. If an administrator or another visitor views a page containing these files, an attacker could execute unauthorized scripts in their browser, potentially leading to account takeover or the theft of sensitive session information.

Technologies: B2evolution. Vendors: B2evolution.

Quick answers

Is CVE-2017-5494 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2017-5494 being exploited in the wild.
How severe is CVE-2017-5494?: Medium severity, with a CVSS score of 5.4, published 15 January 2017.
Which products and versions are affected?: b2evolution b2evolution through 6.8.3.
Is there a fix for CVE-2017-5494?: A patch was published on 2017-01-15: Fix committed to b2evolution repository Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2017-5494 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2017-5494?: Check whether you run B2evolution. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

Multiple stored cross-site scripting (XSS) vulnerabilities exist in b2evolution through version 6.8.3. The root cause is an insecure upload policy in the file types table that allows authenticated users to upload Adobe Flash (.swf) files for use in comment or avatar frames. Because these files are subsequently rendered via the flowplayer_plugin without adequate sanitization, an attacker can embed malicious ActionScript within the SWF file to execute arbitrary JavaScript in the context of the victim's browser session. This requires the attacker to have basic authenticated access to post comments or update a profile. A patch was released to restrict SWF uploads to administrators only.

Affected products

b2evolution b2evolution through 6.8.3

Timeline

2017-01-14: disclosed: Issue reported on GitHub
2017-01-15: advisory: NVD published CVE-2017-5494
2017-01-15: patched: Fix committed to b2evolution repository

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.