Medium severity · published Mar 6, 2018
CVE-2017-9786
Cross-site scripting (XSS) vulnerability in ProjectSend (formerly cFTP) before commit 6c3710430be26feb5371cb0377e5355d6f9a27ca allows remote attackers to inject arbitrary web…
6.1
CVSS
1%
EPSS
No
On KEV
Description
Cross-site scripting (XSS) vulnerability in ProjectSend (formerly cFTP) before commit 6c3710430be26feb5371cb0377e5355d6f9a27ca allows remote attackers to inject arbitrary web script or HTML via the Description field in My account Name updated, related to home.php and actions-log.php.
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)1.0% · higher than 64% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
PR
Projectsend · Projectsend
through r754 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2017-9786
CVE.org
https://www.cve.org/CVERecord?id=CVE-2017-9786
Patch
https://github.com/ignacionelson/ProjectSend/pull/448/commits/6c3710430be26feb5371cb0377e5355d6f9a27ca
More from Projectsend
9.8
CVE-2024-11680
ProjectSend Unauthenticated Configuration Modification
9.8
CVE-2023-53980
ProjectSend r1605 Remote Code Execution via File Extension Manipulation
9.8
CVE-2021-40887
Projectsend version r1295 is affected by a directory traversal vulnerability
9.8
CVE-2016-10734
ProjectSend (formerly cFTP) r582 allows Insecure Direct Object Reference via includes/actions.log.export.php
9.8
CVE-2016-10733
ProjectSend (formerly cFTP) r582 allows directory traversal via file=../ in the process-zip-download.php query string