CVE-2017-2661
Advisory lineage Upstream: 0 Downstream: 3
Modified
Published: 12 Mar 2018, 15:00
Last modified:16 Sept 2024, 17:28
Vulnerability Summary
Overall Risk (default)
low
24/100 CVSS Score
6.1 MEDIUM
v3.0 (nvd)
EPSS Score
0.21% LOW
0% probability -0.19%
KEV
Not listed
Ransomware
No reports
Public exploits
None found
Dark Web
Not detected
Timeline
12 Mar 2018, 15:00
Published
Vulnerability first disclosed
16 Sept 2024, 17:28
Last Modified
Vulnerability information updated
Description
ClusterLabs pcs before version 0.9.157 is vulnerable to a cross-site scripting vulnerability due to improper validation of Node name field when creating new cluster or adding existing cluster.
CVSS Metrics
- v3.0•MEDIUM•Score: 6.1CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
- v2.0•MEDIUM•Score: 4.3AV:N/AC:M/Au:N/C:N/I:P/A:N
EPSS Trends
Current EPSS score: 0.21%• Percentile: 43%
Techniques & Countermeasures
- CWE-79•Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Affected Systems
- clusterlabs•pcs
< 0.9.157 | 0.9.157