CVE-2016-10510 - Vulnerability Details - OpenCVE

Cross-site scripting (XSS) vulnerability in the Security component of Kohana before 3.3.6 allows remote attackers to inject arbitrary web script or HTML by bypassing the strip_image_tags protection mechanism in system/classes/Kohana/Security.php.

No CVSS v4.0

No CVSS v3.1

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Changed

Confidentiality Impact Low

Integrity Impact Low

Availability Impact None

User Interaction Required

Access Vector Network

Access Complexity Medium

Authentication None

Confidentiality Impact None

Integrity Impact Partial

Availability Impact None

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

Vendors	Products
Debian	Debian Linux
Kohanaframework	Kohana

Configuration 1 [-]

cpe:2.3:a:kohanaframework:kohana:*:*:*:*:*:*:*:*

Configuration 2 [-]

cpe:2.3:o:debian:debian_linux:7.0:*:*:*:*:*:*:*

No data.

References

Link	Providers
https://advisory.checkmarx.net/advisory/CX-2016-4451
https://github.com/kohana/kohana/issues/107
https://github.com/kohana/kohana/releases/tag/v3.3.6
https://lists.debian.org/debian-lts-announce/2018/01/msg00015.html
https://www.checkmarx.com/advisories/cross-site-scripting-xss-vulnerability-in-kohana/

History

No history.

MITRE

Status: PUBLISHED

Assigner: mitre

Published: 2017-08-31T20:00:00

Updated: 2024-08-06T03:21:52.147Z

Reserved: 2017-08-31T00:00:00

Link: CVE-2016-10510

Vulnrichment

No data.

NVD

Status : Deferred

Published: 2017-08-31T20:29:00.323

Modified: 2025-04-20T01:37:25.860

Link: CVE-2016-10510

Redhat

No data.

{"containers": {"cna": {"affected": [{"product": "n/a", "vendor": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}], "datePublic": "2017-08-31T00:00:00", "descriptions": [{"lang": "en", "value": "Cross-site scripting (XSS) vulnerability in the Security component of Kohana before 3.3.6 allows remote attackers to inject arbitrary web script or HTML by bypassing the strip_image_tags protection mechanism in system/classes/Kohana/Security.php."}], "problemTypes": [{"descriptions": [{"description": "n/a", "lang": "en", "type": "text"}]}], "providerMetadata": {"dateUpdated": "2021-03-31T19:19:59", "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre"}, "references": [{"name": "[debian-lts-announce] 20180114 [SECURITY] [DLA 1241-1] libkohana2-php security update", "tags": ["mailing-list", "x_refsource_MLIST"], "url": "https://lists.debian.org/debian-lts-announce/2018/01/msg00015.html"}, {"tags": ["x_refsource_CONFIRM"], "url": "https://github.com/kohana/kohana/releases/tag/v3.3.6"}, {"tags": ["x_refsource_CONFIRM"], "url": "https://github.com/kohana/kohana/issues/107"}, {"tags": ["x_refsource_MISC"], "url": "https://www.checkmarx.com/advisories/cross-site-scripting-xss-vulnerability-in-kohana/"}, {"tags": ["x_refsource_MISC"], "url": "https://advisory.checkmarx.net/advisory/CX-2016-4451"}], "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "cve@mitre.org", "ID": "CVE-2016-10510", "STATE": "PUBLIC"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "n/a", "version": {"version_data": [{"version_value": "n/a"}]}}]}, "vendor_name": "n/a"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "Cross-site scripting (XSS) vulnerability in the Security component of Kohana before 3.3.6 allows remote attackers to inject arbitrary web script or HTML by bypassing the strip_image_tags protection mechanism in system/classes/Kohana/Security.php."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "n/a"}]}]}, "references": {"reference_data": [{"name": "[debian-lts-announce] 20180114 [SECURITY] [DLA 1241-1] libkohana2-php security update", "refsource": "MLIST", "url": "https://lists.debian.org/debian-lts-announce/2018/01/msg00015.html"}, {"name": "https://github.com/kohana/kohana/releases/tag/v3.3.6", "refsource": "CONFIRM", "url": "https://github.com/kohana/kohana/releases/tag/v3.3.6"}, {"name": "https://github.com/kohana/kohana/issues/107", "refsource": "CONFIRM", "url": "https://github.com/kohana/kohana/issues/107"}, {"name": "https://www.checkmarx.com/advisories/cross-site-scripting-xss-vulnerability-in-kohana/", "refsource": "MISC", "url": "https://www.checkmarx.com/advisories/cross-site-scripting-xss-vulnerability-in-kohana/"}, {"name": "https://advisory.checkmarx.net/advisory/CX-2016-4451", "refsource": "MISC", "url": "https://advisory.checkmarx.net/advisory/CX-2016-4451"}]}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-06T03:21:52.147Z"}, "title": "CVE Program Container", "references": [{"name": "[debian-lts-announce] 20180114 [SECURITY] [DLA 1241-1] libkohana2-php security update", "tags": ["mailing-list", "x_refsource_MLIST", "x_transferred"], "url": "https://lists.debian.org/debian-lts-announce/2018/01/msg00015.html"}, {"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "https://github.com/kohana/kohana/releases/tag/v3.3.6"}, {"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "https://github.com/kohana/kohana/issues/107"}, {"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://www.checkmarx.com/advisories/cross-site-scripting-xss-vulnerability-in-kohana/"}, {"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://advisory.checkmarx.net/advisory/CX-2016-4451"}]}]}, "cveMetadata": {"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "assignerShortName": "mitre", "cveId": "CVE-2016-10510", "datePublished": "2017-08-31T20:00:00", "dateReserved": "2017-08-31T00:00:00", "dateUpdated": "2024-08-06T03:21:52.147Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:kohanaframework:kohana:*:*:*:*:*:*:*:*", "matchCriteriaId": "524BCE3A-200E-4184-8961-B61D736D25CD", "versionEndIncluding": "3.3.5", "vulnerable": true}], "negate": false, "operator": "OR"}]}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:debian:debian_linux:7.0:*:*:*:*:*:*:*", "matchCriteriaId": "16F59A04-14CF-49E2-9973-645477EA09DA", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Cross-site scripting (XSS) vulnerability in the Security component of Kohana before 3.3.6 allows remote attackers to inject arbitrary web script or HTML by bypassing the strip_image_tags protection mechanism in system/classes/Kohana/Security.php."}, {"lang": "es", "value": "Una vulnerabilidad de tipo Cross-Site Scripting (XSS) en el componente de seguridad de Kohana en versiones anteriores a la 3.3.6 permite que los atacantes remotos inyecten scripts web o HTML arbitrarios al omitir el mecanismo de protecci\u00f3n de strip_image_tags en system/classes/Kohana/Security.php."}], "id": "CVE-2016-10510", "lastModified": "2025-04-20T01:37:25.860", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "MEDIUM", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "NONE", "baseScore": 4.3, "confidentialityImpact": "NONE", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N", "version": "2.0"}, "exploitabilityScore": 8.6, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": true}], "cvssMetricV30": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.1, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "version": "3.0"}, "exploitabilityScore": 2.8, "impactScore": 2.7, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2017-08-31T20:29:00.323", "references": [{"source": "cve@mitre.org", "url": "https://advisory.checkmarx.net/advisory/CX-2016-4451"}, {"source": "cve@mitre.org", "tags": ["Exploit", "Patch", "Third Party Advisory"], "url": "https://github.com/kohana/kohana/issues/107"}, {"source": "cve@mitre.org", "tags": ["Release Notes", "Third Party Advisory"], "url": "https://github.com/kohana/kohana/releases/tag/v3.3.6"}, {"source": "cve@mitre.org", "tags": ["Mailing List", "Third Party Advisory"], "url": "https://lists.debian.org/debian-lts-announce/2018/01/msg00015.html"}, {"source": "cve@mitre.org", "tags": ["Exploit", "Third Party Advisory"], "url": "https://www.checkmarx.com/advisories/cross-site-scripting-xss-vulnerability-in-kohana/"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://advisory.checkmarx.net/advisory/CX-2016-4451"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Exploit", "Patch", "Third Party Advisory"], "url": "https://github.com/kohana/kohana/issues/107"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Release Notes", "Third Party Advisory"], "url": "https://github.com/kohana/kohana/releases/tag/v3.3.6"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Mailing List", "Third Party Advisory"], "url": "https://lists.debian.org/debian-lts-announce/2018/01/msg00015.html"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Exploit", "Third Party Advisory"], "url": "https://www.checkmarx.com/advisories/cross-site-scripting-xss-vulnerability-in-kohana/"}], "sourceIdentifier": "cve@mitre.org", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "nvd@nist.gov", "type": "Primary"}]}