CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
What the vulnerability does
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in icopydoc Import from YML import-from-yml allows Reflected XSS.This issue affects Import from YML: from n/a through <= 3.1.17.
Explanation of Vulnerability in Simple Terms
Import from YML versions 3.1.17 and earlier contain a cross-site scripting (XSS) vulnerability. An attacker can inject malicious scripts into YML import data that execute in a user's browser when they view the imported content. The vulnerability requires user interaction—specifically, a victim must visit a page containing the malicious import. The impact is limited to the affected user's session.
What an attacker can do
Inject malicious scripts that run in users' browsers when they view imported YML content.
Potential impact on your site
Users viewing imported YML data could have their sessions compromised or credentials stolen via injected scripts.
Conditions required to exploit
No authentication required. Victim must visit a page containing the malicious YML import.
Key dates
External resources
Related vulnerabilities
