Strix
26.1K

CVE-2017-5963

UnknownEPSS 1.03%

Last modified

CVE-2017-5963 is a vulnerability of currently unknown severity. An issue was discovered in caddy (for TYPO3) before 7.2.10. The vulnerability exists due to insufficient filtration of user-supplied data in the "paymillToken" HTTP POST parameter passed to the "caddy/Resources/Public/JavaScript/e-payment/paymill/api/php/payment.php" URL. EPSS estimates a 1.03% chance of exploitation in the next 30 days.

Description

An issue was discovered in caddy (for TYPO3) before 7.2.10. The vulnerability exists due to insufficient filtration of user-supplied data in the "paymillToken" HTTP POST parameter passed to the "caddy/Resources/Public/JavaScript/e-payment/paymill/api/php/payment.php" URL. An attacker could execute arbitrary HTML and script code in a browser in the context of the vulnerable website.

Metrics

EPSS Probability
1.03%

59.2th percentile

Probability of exploitation in the next 30 days. Learn more

Weakness Enumeration

Affected Software

VendorProductVersionsUpdate
Caddy ProjectCaddy2.1.4Alpha
Caddy ProjectCaddy2.1.5Alpha
Caddy ProjectCaddy2.1.6Alpha
Caddy ProjectCaddy3.0.0Alpha
Caddy ProjectCaddy4.0.0Alpha
Caddy ProjectCaddy4.0.1Alpha
Caddy ProjectCaddy4.0.2Alpha
Caddy ProjectCaddy4.0.3Alpha
Caddy ProjectCaddy4.0.12Alpha
Caddy ProjectCaddy6.0.1Alpha
Caddy ProjectCaddy6.0.2Alpha
Caddy ProjectCaddy6.0.9Alpha
Caddy ProjectCaddy6.0.12Beta
Caddy ProjectCaddy6.0.14Beta
Caddy ProjectCaddy6.1.0Beta
Caddy ProjectCaddy6.2.1Beta
Caddy ProjectCaddy6.3.0Beta
Caddy ProjectCaddy6.3.1Beta
Caddy ProjectCaddy6.3.3Beta
Caddy ProjectCaddy7.0.0Beta
Caddy ProjectCaddy7.1.0Beta
Caddy ProjectCaddy7.2.7Beta

References

Timeline

Published
Last Modified
Status
Modified

Frequently Asked Questions

What is CVE-2017-5963?
An issue was discovered in caddy (for TYPO3) before 7.2.10. The vulnerability exists due to insufficient filtration of user-supplied data in the "paymillToken" HTTP POST parameter passed to the "caddy/Resources/Public/JavaScript/e-payment/paymill/api/php/payment.php" URL. An attacker could execute arbitrary HTML and script code in a browser in the context of the vulnerable website.
How severe is CVE-2017-5963?
Severity scoring for CVE-2017-5963 is pending analysis. The EPSS model estimates a 1.03% probability of exploitation in the next 30 days.
How do I fix CVE-2017-5963?
Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.

Are you affected by CVE-2017-5963?

Run a free Strix scan to check your systems for this vulnerability.

Scan your code now

Source: NVD / NIST