CVE-2015-1053

NONE EPSS 80.5%

Published Jan 16, 201511y ago · Modified Jun 17, 20262w ago

Published Jan 16, 2015 11y ago

Last Modified Jun 17, 2026 2w ago

Description

Cross-site scripting (XSS) vulnerability in the administrative backend in Croogo before 2.2.1 allows remote attackers to inject arbitrary web script or HTML via the path parameter to admin/file_manager/file_manager/editfile.

Threat Intelligence

EPSS Exploit Probability

80.5% percentile

Exploit & Patch Status

Public Exploit Known

Patch Available

Weaknesses 1

CWE-79 Cross-site Scripting Injection

Affected Products 1

Vendor	Product	Version	Range
croogo	croogo	*	≤2.2.0

References 8

packetstormsecurity.com http://packetstormsecurity.com/files/129916/CMS-Croogo-2.2.0-Cross-Site-Scripting.html

Exploit
seclists.org http://seclists.org/fulldisclosure/2015/Jan/24

Exploit
sroesemann.blogspot.de http://sroesemann.blogspot.de/2015/01/report-for-advisory-sroeadv-2015-02.html

Exploit
sroesemann.blogspot.de http://sroesemann.blogspot.de/2015/01/sroeadv-2015-02.html

Exploit
securityfocus.com http://www.securityfocus.com/bid/71999

Exploit
blog.croogo.org https://blog.croogo.org/blog/croogo-221-released

PatchVendor Advisory
exchange.xforce.ibmcloud.com https://exchange.xforce.ibmcloud.com/vulnerabilities/99890
github.com https://github.com/croogo/croogo/issues/599

Remediation

blog.croogo.org https://blog.croogo.org/blog/croogo-221-released

PatchVendor Advisory