CVE-2015-8831

NONE EPSS 79.2%

Published Feb 9, 20179y ago · Modified Jun 17, 20262w ago

Published Feb 9, 2017 9y ago

Last Modified Jun 17, 2026 2w ago

Description

Cross-site scripting (XSS) vulnerability in admin/comments.php in Dotclear before 2.8.2 allows remote attackers to inject arbitrary web script or HTML via the author name in a comment.

Threat Intelligence

EPSS Exploit Probability

79.2% percentile

Exploit & Patch Status

Public Exploit Known

Patch Available

Weaknesses 1

CWE-79 Cross-site Scripting Injection

Affected Products 1

Vendor	Product	Version	Range
dotclear	dotclear	*	≤2.8.1

References 8

dotclear.org http://dotclear.org/blog/post/2015/10/25/Dotclear-2.8.2

Release NotesVendor Advisory
packetstormsecurity.com http://packetstormsecurity.com/files/134353/dotclear-2.8.1-Cross-Site-Scripting.html

ExploitThird Party AdvisoryVDB Entry
seclists.org http://seclists.org/fulldisclosure/2015/Nov/59

Mailing ListPatchThird Party Advisory
openwall.com http://www.openwall.com/lists/oss-security/2016/03/05/4

Mailing ListPatchThird Party Advisory
openwall.com http://www.openwall.com/lists/oss-security/2016/03/07/5

Mailing ListPatchThird Party Advisory
securityfocus.com http://www.securityfocus.com/bid/96377
blog.curesec.com https://blog.curesec.com/article/blog/dotclear-281-XSS-94.html

ExploitPatchThird Party Advisory
hg.dotclear.org https://hg.dotclear.org/dotclear/rev/65e65154dadf

Issue TrackingPatchVendor Advisory

Remediation

seclists.org http://seclists.org/fulldisclosure/2015/Nov/59

Mailing ListPatchThird Party Advisory
openwall.com http://www.openwall.com/lists/oss-security/2016/03/05/4

Mailing ListPatchThird Party Advisory
openwall.com http://www.openwall.com/lists/oss-security/2016/03/07/5

Mailing ListPatchThird Party Advisory
blog.curesec.com https://blog.curesec.com/article/blog/dotclear-281-XSS-94.html

ExploitPatchThird Party Advisory
hg.dotclear.org https://hg.dotclear.org/dotclear/rev/65e65154dadf

Issue TrackingPatchVendor Advisory