« Volver al listado

CVE-2017-7251

Estado: ModificadaMedia (6.1)—

Una secuencia de comandos en sitios cruzados (XSS) fue descubierta en pi-engine/pi 2.5.0. La vulnerabilidad existe debido a una filtración insuficiente de los datos suministrados por el usuario (vista previa) pasados a la URL "pi-develop/www/script/editor/markitup/preview/markdown.php". Un atacante podría ejecutar HTML arbitrario y código script en un navegador en el contexto de un sitio web vulnerable.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Piengine — PI

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2017-7251",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 4.3,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
          "authentication": "NONE",
          "integrityImpact": "PARTIAL",
          "accessComplexity": "MEDIUM",
          "availabilityImpact": "NONE",
          "confidentialityImpact": "NONE"
        },
        "acInsufInfo": false,
        "impactScore": 2.9,
        "baseSeverity": "MEDIUM",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 8.6,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": true
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "CHANGED",
          "version": "3.1",
          "baseScore": 6.1,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
          "integrityImpact": "LOW",
          "userInteraction": "REQUIRED",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "LOW"
        },
        "impactScore": 2.7,
        "exploitabilityScore": 2.8
      }
    ]
  },
  "affected": [
    {
      "source": "cve@mitre.org",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    }
  ],
  "published": "2017-03-23T22:59:00.307",
  "references": [
    {
      "url": "http://www.securityfocus.com/bid/97061",
      "tags": [
        "Third Party Advisory",
        "VDB Entry"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "https://github.com/pi-engine/pi/issues/1523",
      "tags": [
        "Patch",
        "Third Party Advisory"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.securityfocus.com/bid/97061",
      "tags": [
        "Third Party Advisory",
        "VDB Entry"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://github.com/pi-engine/pi/issues/1523",
      "tags": [
        "Patch",
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-79"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "A Cross-Site Scripting (XSS) was discovered in pi-engine/pi 2.5.0. The vulnerability exists due to insufficient filtration of user-supplied data (preview) passed to the \"pi-develop/www/script/editor/markitup/preview/markdown.php\" URL. An attacker could execute arbitrary HTML and script code in a browser in the context of the vulnerable website."
    },
    {
      "lang": "es",
      "value": "Una secuencia de comandos en sitios cruzados (XSS) fue descubierta en pi-engine/pi 2.5.0. La vulnerabilidad existe debido a una filtración insuficiente de los datos suministrados por el usuario (vista previa) pasados a la URL \"pi-develop/www/script/editor/markitup/preview/markdown.php\". Un atacante podría ejecutar HTML arbitrario y código script en un navegador en el contexto de un sitio web vulnerable."
    }
  ],
  "lastModified": "2026-06-17T01:23:56.840",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:piengine:pi:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "CAB3CF37-5F4D-4650-B622-58204457ECFB",
              "versionEndIncluding": "2.5.0"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "cve@mitre.org"
}