Executive brief
Symphony CMS, a content management system used for building websites, is vulnerable to a security flaw that allows attackers to run malicious scripts in a user's browser. By tricking a user into clicking a specially crafted link, an attacker could steal login session information or perform unauthorized actions on the user's behalf. This issue affects versions of the software prior to 2.6.10.
Technical details
A reflected cross-site scripting (XSS) vulnerability exists in Symphony CMS before version 2.6.10 within the 'template/usererror.missing_extension.php' component. The vulnerability is caused by insufficient sanitization of the 'existing-folder' URL parameter. A remote, unauthenticated attacker can exploit this by persuading a user to visit a malicious URL, leading to the execution of arbitrary HTML or JavaScript in the context of the user's browser session. This can result in session hijacking or unauthorized modification of page content. The issue was addressed in the 2.6.10 release.
Affected products
- Symphony CMS Symphony CMS before 2.6.10
Timeline
- 2017-01-17: patched: Version 2.6.10 released to fix XSS and path traversal issues.
- 2017-01-20: disclosed: NVD publication date.