CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:L
What the vulnerability does
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Eli Anti-Malware Security and Brute-Force Firewall gotmls allows Reflected XSS.This issue affects Anti-Malware Security and Brute-Force Firewall: from n/a through <= 4.23.89.
Explanation of Vulnerability in Simple Terms
A cross-site scripting (XSS) vulnerability in Eli Anti-Malware Security and Brute-Force Firewall versions up to 4.23.89 allows an attacker to inject malicious scripts that execute in users' browsers. The vulnerability requires user interaction—such as clicking a malicious link—and affects the confidentiality, integrity, and availability of the site. Update to a version newer than 4.23.89 to remediate.
What an attacker can do
Inject malicious scripts that run in users' browsers when they visit a crafted link or page.
Potential impact on your site
Visitors could have sessions hijacked, credentials stolen, or malware injected into their browsers.
Conditions required to exploit
User must click a malicious link or visit an attacker-controlled page; no authentication required.
Key dates
External resources
Related vulnerabilities
