« Volver al listado

CVE-2017-5962

Estado: ModificadaMedia (6.1)—

An issue was discovered in contexts_wurfl (for TYPO3) before 0.4.2. The vulnerability exists due to insufficient filtration of user-supplied data in the "force_ua" HTTP GET parameter passed to the "/contexts_wurfl/Library/wurfl-dbapi-1.4.4.0/check_wurfl.php" URL. An attacker could execute arbitrary HTML and script code in a browser in the context of the vulnerable website.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Netresearch — Contexts Wurfl

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2017-5962",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 4.3,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
          "authentication": "NONE",
          "integrityImpact": "PARTIAL",
          "accessComplexity": "MEDIUM",
          "availabilityImpact": "NONE",
          "confidentialityImpact": "NONE"
        },
        "acInsufInfo": false,
        "impactScore": 2.9,
        "baseSeverity": "MEDIUM",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 8.6,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": true
      }
    ],
    "cvssMetricV30": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "CHANGED",
          "version": "3.0",
          "baseScore": 6.1,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
          "integrityImpact": "LOW",
          "userInteraction": "REQUIRED",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "LOW"
        },
        "impactScore": 2.7,
        "exploitabilityScore": 2.8
      }
    ]
  },
  "affected": [
    {
      "source": "cve@mitre.org",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    }
  ],
  "published": "2017-02-12T04:59:00.237",
  "references": [
    {
      "url": "http://www.securityfocus.com/bid/96158",
      "tags": [
        "Third Party Advisory",
        "VDB Entry"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "https://forge.typo3.org/issues/79326",
      "tags": [
        "Patch",
        "Third Party Advisory"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.securityfocus.com/bid/96158",
      "tags": [
        "Third Party Advisory",
        "VDB Entry"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://forge.typo3.org/issues/79326",
      "tags": [
        "Patch",
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-79"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "An issue was discovered in contexts_wurfl (for TYPO3) before 0.4.2. The vulnerability exists due to insufficient filtration of user-supplied data in the \"force_ua\" HTTP GET parameter passed to the \"/contexts_wurfl/Library/wurfl-dbapi-1.4.4.0/check_wurfl.php\" URL. An attacker could execute arbitrary HTML and script code in a browser in the context of the vulnerable website."
    },
    {
      "lang": "es",
      "value": "Se descubrió un problema en contexts_wurfl (para TYPO3) en versiones anteriores a 0.4.2. La vulnerabilidad existe debido a la filtración insuficiente de datos suministrados por el usuario en el parámetro \"force_ua\" de HTTP GET pasado a la URL \"/contexts_wurfl/Library/wurfl-dbapi-1.4.4.0/check_wurfl.php\". Un atacante podría ejecutar código HTML y secuencias de comandos en un navegador en el contexto del sitio web vulnerable."
    }
  ],
  "lastModified": "2026-06-17T01:21:31.087",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:netresearch:contexts_wurfl:0.2.0:alpha:*:*:*:typo3:*:*",
              "vulnerable": true,
              "matchCriteriaId": "CAF682B6-156B-4FC4-BF6C-B81CB0A9C7F1"
            },
            {
              "criteria": "cpe:2.3:a:netresearch:contexts_wurfl:0.2.1:alpha:*:*:*:typo3:*:*",
              "vulnerable": true,
              "matchCriteriaId": "7CE2302A-66F1-4E6B-B50B-1918CAEB43AF"
            },
            {
              "criteria": "cpe:2.3:a:netresearch:contexts_wurfl:0.2.2:alpha:*:*:*:typo3:*:*",
              "vulnerable": true,
              "matchCriteriaId": "D951F679-A7B9-4727-8FB8-28FD985F3B87"
            },
            {
              "criteria": "cpe:2.3:a:netresearch:contexts_wurfl:0.3.0:alpha:*:*:*:typo3:*:*",
              "vulnerable": true,
              "matchCriteriaId": "372BA7A5-4F29-41E4-8375-383EB4ED5B51"
            },
            {
              "criteria": "cpe:2.3:a:netresearch:contexts_wurfl:0.3.1:alpha:*:*:*:typo3:*:*",
              "vulnerable": true,
              "matchCriteriaId": "495B8185-B8E2-4317-9D78-E37C47B53D2B"
            },
            {
              "criteria": "cpe:2.3:a:netresearch:contexts_wurfl:0.4.0:alpha:*:*:*:typo3:*:*",
              "vulnerable": true,
              "matchCriteriaId": "B0589212-440A-456B-BE76-41795C9A57BD"
            },
            {
              "criteria": "cpe:2.3:a:netresearch:contexts_wurfl:0.4.1:alpha:*:*:*:typo3:*:*",
              "vulnerable": true,
              "matchCriteriaId": "958ED52F-977B-4AF8-A8D8-D26836AF9C39"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "cve@mitre.org"
}