CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L
What the vulnerability does
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Moss Web Works MWW Disclaimer Buttons allows Stored XSS.This issue affects MWW Disclaimer Buttons: from n/a through 3.0.2.
Explanation of Vulnerability in Simple Terms
MWW Disclaimer Buttons through version 3.0.2 contains a stored cross-site scripting (XSS) vulnerability. An authenticated administrator can inject malicious JavaScript into disclaimer button content. When other users view pages containing the affected buttons, the injected script executes in their browsers, potentially compromising their sessions or stealing data. The vulnerability requires administrative access and user interaction to trigger.
What an attacker can do
Run malicious JavaScript in visitors' browsers to steal session data or redirect them to phishing sites.
Potential impact on your site
Compromised user sessions, data theft, or malware distribution affecting site visitors who view affected disclaimer buttons.
Conditions required to exploit
Attacker must have administrator access to the site and a user must view a page with the malicious button.
Key dates
External resources
Related vulnerabilities
