CVE-2017-8897 - Vulnerability Details - OpenCVE

Invision Power Services (IPS) Community Suite 4.1.19.2 and earlier has pre-auth reflected XSS in the IPS UTF8 Converter v1.1.18: admin/convertutf8/index.php?controller= is the attack vector. This UTF8 Converter vulnerability can easily be used to make a malicious announcement affecting any Invision Power Board user who views the announcement.

No CVSS v4.0

No CVSS v3.1

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Changed

Confidentiality Impact Low

Integrity Impact Low

Availability Impact None

User Interaction Required

Access Vector Network

Access Complexity Medium

Authentication None

Confidentiality Impact None

Integrity Impact Partial

Availability Impact None

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

Vendors	Products
Invisioncommunity	Invision Power Board

Configuration 1 [-]

cpe:2.3:a:invisioncommunity:invision_power_board:*:*:*:*:*:*:*:*

No data.

References

Link	Providers
http://zeroday.insecurity.zone/exploits/ipb_owned.txt
https://twitter.com/insecurity/status/862154908895780864
https://twitter.com/sxcurity/status/862284967715381248

History

No history.

MITRE

Status: PUBLISHED

Assigner: mitre

Published: 2017-05-11T17:00:00Z

Updated: 2024-09-16T23:40:53.814Z

Reserved: 2017-05-11T00:00:00Z

Link: CVE-2017-8897

Vulnrichment

No data.

NVD

Status : Modified

Published: 2017-05-11T17:29:00.160

Modified: 2024-11-21T03:34:55.857

Link: CVE-2017-8897

Redhat

No data.

{"containers": {"cna": {"affected": [{"product": "n/a", "vendor": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}], "descriptions": [{"lang": "en", "value": "Invision Power Services (IPS) Community Suite 4.1.19.2 and earlier has pre-auth reflected XSS in the IPS UTF8 Converter v1.1.18: admin/convertutf8/index.php?controller= is the attack vector. This UTF8 Converter vulnerability can easily be used to make a malicious announcement affecting any Invision Power Board user who views the announcement."}], "problemTypes": [{"descriptions": [{"description": "n/a", "lang": "en", "type": "text"}]}], "providerMetadata": {"dateUpdated": "2017-05-11T17:00:00Z", "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre"}, "references": [{"tags": ["x_refsource_MISC"], "url": "http://zeroday.insecurity.zone/exploits/ipb_owned.txt"}, {"tags": ["x_refsource_MISC"], "url": "https://twitter.com/insecurity/status/862154908895780864"}, {"tags": ["x_refsource_MISC"], "url": "https://twitter.com/sxcurity/status/862284967715381248"}], "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "cve@mitre.org", "ID": "CVE-2017-8897", "STATE": "PUBLIC"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "n/a", "version": {"version_data": [{"version_value": "n/a"}]}}]}, "vendor_name": "n/a"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "Invision Power Services (IPS) Community Suite 4.1.19.2 and earlier has pre-auth reflected XSS in the IPS UTF8 Converter v1.1.18: admin/convertutf8/index.php?controller= is the attack vector. This UTF8 Converter vulnerability can easily be used to make a malicious announcement affecting any Invision Power Board user who views the announcement."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "n/a"}]}]}, "references": {"reference_data": [{"name": "http://zeroday.insecurity.zone/exploits/ipb_owned.txt", "refsource": "MISC", "url": "http://zeroday.insecurity.zone/exploits/ipb_owned.txt"}, {"name": "https://twitter.com/insecurity/status/862154908895780864", "refsource": "MISC", "url": "https://twitter.com/insecurity/status/862154908895780864"}, {"name": "https://twitter.com/sxcurity/status/862284967715381248", "refsource": "MISC", "url": "https://twitter.com/sxcurity/status/862284967715381248"}]}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-05T16:48:22.668Z"}, "title": "CVE Program Container", "references": [{"tags": ["x_refsource_MISC", "x_transferred"], "url": "http://zeroday.insecurity.zone/exploits/ipb_owned.txt"}, {"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://twitter.com/insecurity/status/862154908895780864"}, {"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://twitter.com/sxcurity/status/862284967715381248"}]}]}, "cveMetadata": {"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "assignerShortName": "mitre", "cveId": "CVE-2017-8897", "datePublished": "2017-05-11T17:00:00Z", "dateReserved": "2017-05-11T00:00:00Z", "dateUpdated": "2024-09-16T23:40:53.814Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:invisioncommunity:invision_power_board:*:*:*:*:*:*:*:*", "matchCriteriaId": "D7A015E6-3AFD-4A33-AA69-172D6161DCD1", "versionEndIncluding": "4.1.19.2", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "descriptions": [{"lang": "en", "value": "Invision Power Services (IPS) Community Suite 4.1.19.2 and earlier has pre-auth reflected XSS in the IPS UTF8 Converter v1.1.18: admin/convertutf8/index.php?controller= is the attack vector. This UTF8 Converter vulnerability can easily be used to make a malicious announcement affecting any Invision Power Board user who views the announcement."}, {"lang": "es", "value": "Invision Power Services (IPS) Community Suite 4.1.19.2 y anteriores tiene XSS reflejado previo a la autenticaci\u00f3n en el IPS UTF8 Converter v1.1.18: El vector de ataque es admin/convertutf8/index.php?Controller=. Esta vulnerabilidad del UTF8 Converter puede usarse f\u00e1cilmente para hacer un anuncio malicioso que afecte a cualquier usuario de Invision Power Board que vea el anuncio."}], "id": "CVE-2017-8897", "lastModified": "2024-11-21T03:34:55.857", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "MEDIUM", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "NONE", "baseScore": 4.3, "confidentialityImpact": "NONE", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N", "version": "2.0"}, "exploitabilityScore": 8.6, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": true}], "cvssMetricV30": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.1, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "version": "3.0"}, "exploitabilityScore": 2.8, "impactScore": 2.7, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2017-05-11T17:29:00.160", "references": [{"source": "cve@mitre.org", "tags": ["Third Party Advisory", "VDB Entry"], "url": "http://zeroday.insecurity.zone/exploits/ipb_owned.txt"}, {"source": "cve@mitre.org", "tags": ["Third Party Advisory"], "url": "https://twitter.com/insecurity/status/862154908895780864"}, {"source": "cve@mitre.org", "tags": ["Exploit", "Third Party Advisory"], "url": "https://twitter.com/sxcurity/status/862284967715381248"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Third Party Advisory", "VDB Entry"], "url": "http://zeroday.insecurity.zone/exploits/ipb_owned.txt"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Third Party Advisory"], "url": "https://twitter.com/insecurity/status/862154908895780864"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Exploit", "Third Party Advisory"], "url": "https://twitter.com/sxcurity/status/862284967715381248"}], "sourceIdentifier": "cve@mitre.org", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "nvd@nist.gov", "type": "Primary"}]}