CVE-2017-18286: nZEDb Cross-site Scripting (XSS) in the 404 error page
Summary
CVE-2017-18286: nZEDb Cross-site Scripting (XSS) in the 404 error page. Affects nzedb/nzedb versions < 0.8.0.0. Fixed in 0.8.0.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
nZEDb is a package available on Packagist that provides functionality for creating and managing Usenet indexing websites. It allows users to search and download content from Usenet servers. The package is widely used and has a large user base. However, it is vulnerable to a cross-site scripting (XSS) attack on the 404 error page.
Vulnerability Detail
The vulnerability in nZEDb before version 0.8.0.0 allows an attacker to inject malicious scripts into the 404 error page. This can be exploited by tricking a user into visiting a specially crafted URL that triggers the 404 error page. When the page is rendered, the injected script will execute in the user's browser, potentially leading to unauthorized actions or data theft. The vulnerability has a CVSS score of 5.4, indicating a moderate severity level.
How To Fix
Minimum fixed version
0.8.0.0
This is the first release that contains the fix.
composer require nzedb/nzedb:0.8.0.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading to the latest version is not immediately possible, a temporary workaround is to modify the 404 error page template to sanitize user input and prevent the execution of injected scripts. This can be done by implementing input validation and output encoding techniques to ensure that user-supplied data is properly sanitized before being rendered on the page.
Conclusion
The nZEDb package is vulnerable to a cross-site scripting (XSS) attack on the 404 error page. To mitigate this vulnerability, it is recommended to upgrade to version 0.8.0.0 or later. If immediate upgrade is not possible, implementing input validation and output encoding techniques on the 404 error page can serve as a temporary workaround. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for nzedb/nzedb →
FAQ
The vulnerability allows an attacker to execute arbitrary scripts in the context of a user's browser, potentially leading to unauthorized actions or data theft.
While there are no known public exploits for this vulnerability, it is still important to apply the recommended fixes to prevent potential attacks.
No, only versions before 0.8.0.0 are affected. It is recommended to upgrade to the latest version to mitigate the vulnerability.
Yes, an attacker can exploit this vulnerability remotely by tricking a user into visiting a specially crafted URL.
Yes, the CVSS score for this vulnerability is 5.4, indicating a moderate severity level.
