CVSS base score
CVSS vector
CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/AU:Y/R:U/V:D/RE:L/U:Green
What the vulnerability does
Script afGdStream.php in AdmirorFrames Joomla! extension doesn’t specify a content type and as a result default (text/html) is used. An attacker may embed HTML tags directly in image data which is rendered by a webpage as HTML. This issue affects AdmirorFrames: before 5.0.
Explanation of Vulnerability in Simple Terms
AdmirorFrames versions before 5.0 contain a cross-site scripting vulnerability that allows attackers to inject malicious scripts. The vulnerability requires high attack complexity and network access but does not require user interaction or authentication. Successful exploitation can result in integrity and availability impact to the affected system.
What an attacker can do
Inject malicious scripts that execute in the context of the application.
Potential impact on your site
Attackers may inject scripts affecting data integrity or application availability without user action.
Conditions required to exploit
Network access; high attack complexity; no authentication required.
Key dates
External resources
Related vulnerabilities
