CVE-2017-15214

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2017-15214

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2017-15214.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2017-15214

Published

2017-10-11T01:32:55.287Z

Modified

2026-07-08T12:06:31.467809Z

Severity

5.4 (Medium) CVSS_V3 - CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N CVSS Calculator

Summary

[none]

Details

Stored XSS vulnerability in Flyspray 1.0-rc4 before 1.0-rc6 allows an authenticated user to inject JavaScript to gain administrator privileges and also to execute JavaScript against other users (including unauthenticated users), via the name, title, or id parameter to plugins/dokuwiki/lib/plugins/changelinks/syntax.php.

References

Affected packages

Git / github.com/flyspray/flyspray

Affected ranges

Type

GIT

Repo

https://github.com/flyspray/flyspray

Events

Introduced

1d1fd88be239b196d3cc98df57b549f635b6215c

Last affected

1d1fd88be239b196d3cc98df57b549f635b6215c

Fixed

00cfae5661124f9d67ac6733db61b2bfee34dccc

Fixed

7800ed1c37f06a1395ebb2937d7f45fbf13e5167

Database specific

{
    "source": [
        "CPE_STRING",
        "REFERENCES"
    ],
    "cpe": "cpe:2.3:a:flyspray:flyspray:1.0:rc4:*:*:*:*:*:*",
    "extracted_events": [
        {
            "introduced": "1.0-rc4"
        },
        {
            "last_affected": "1.0-rc4"
        }
    ]
}

Affected versions

1.*

1.0-rc4

v1.*

v1.0-rc4

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2017-15214.json"