Deskripsi CVE

Cross-site scripting (XSS) vulnerability in starnet/index.php in SyndeoCMS 3.0.01 and earlier allows remote authenticated users to inject arbitrary web script or HTML via the email parameter (aka Email address field) in an edit_user configuration action.

Informasi CVE

Kelemahan Terkait

CWE-ID	Nama Kelemahan	Sumber
CWE-79	Improper Neutralization of Input During Web Page Generation The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Metrik

Metrik	Skor	Tingkat keparahan	CVSS Vektor	Sumber
V2	3.5		AV:N/AC:M/Au:S/C:N/I:P/A:N	nvd@nist.gov

EPSS

EPSS adalah model penilaian yang memprediksi kemungkinan suatu kerentanan dieksploitasi.

Skor EPSS

Model EPSS menghasilkan skor probabilitas antara 0 dan 1 (0 hingga 100%). Semakin tinggi skor, semakin besar probabilitas bahwa suatu kerentanan akan dieksploitasi.

Persentil EPSS

Persentil digunakan untuk meranking CVE berdasarkan skor EPSS mereka. Misalnya, CVE di persentil ke-95 berdasarkan skor EPSS-nya lebih mungkin dieksploitasi daripada 95% CVE lainnya. Dengan demikian, persentil digunakan untuk membandingkan skor EPSS suatu CVE dengan CVE lainnya.

EPSS First.org

Informasi eksploitasi

Exploit Database EDB-ID : 18686

Tanggal publikasi : 2012-03-29 22h00 +00:00
Penulis : Ivano Binetti
Terverifikasi EDB : Yes

Produk yang Disebutkan

Konfigurasi 0

Syndeocms>>Syndeocms >> Version Hingga (termasuk) 3.0.01

Syndeocms>>Syndeocms >> Version 2.4

Syndeocms>>Syndeocms >> Version 2.4.10

Syndeocms>>Syndeocms >> Version 2.5.00

Syndeocms>>Syndeocms >> Version 2.5.01

Syndeocms>>Syndeocms >> Version 2.6.00

Syndeocms>>Syndeocms >> Version 2.7.00

Syndeocms>>Syndeocms >> Version 2.8.00

Syndeocms>>Syndeocms >> Version 2.8.1

Syndeocms>>Syndeocms >> Version 2.8.02

Syndeocms>>Syndeocms >> Version 2.9.00

Syndeocms>>Syndeocms >> Version 3.0.00

Referensi

http://osvdb.org/80746
Tags : vdb-entry, x_refsource_OSVDB

http://www.securityfocus.com/bid/52840
Tags : vdb-entry, x_refsource_BID

http://www.webapp-security.com/wp-content/uploads/2012/03/syndeocms_3.0.01-Persistent-XSS.txt
Tags : x_refsource_MISC

https://exchange.xforce.ibmcloud.com/vulnerabilities/74545
Tags : vdb-entry, x_refsource_XF

http://www.exploit-db.com/exploits/18686/
Tags : exploit, x_refsource_EXPLOIT-DB

http://packetstormsecurity.org/files/111405/SyndeoCMS-3.0.01-Cross-Site-Scripting.html
Tags : x_refsource_MISC

Tanggal	EPSS V0	EPSS V1	EPSS V2 (> 2022-02-04)	EPSS V3 (> 2025-03-07)	EPSS V4 (> 2025-03-17)
2022-02-06	–	–	2.53%	–	–
2022-03-27	–	–	2.53%	–	–
2022-04-03	–	–	2.55%	–	–
2022-05-29	–	–	2.55%	–	–
2022-07-03	–	–	2.56%	–	–
2022-12-25	–	–	2.56%	–	–
2023-01-01	–	–	2.56%	–	–
2023-02-19	–	–	2.56%	–	–
2023-03-12	–	–	–	0.27%	–
2023-04-02	–	–	–	0.27%	–
2023-09-10	–	–	–	0.27%	–
2024-02-11	–	–	–	0.27%	–
2024-03-24	–	–	–	0.27%	–
2024-06-02	–	–	–	0.27%	–
2024-07-14	–	–	–	0.27%	–
2024-08-04	–	–	–	0.27%	–
2024-08-11	–	–	–	0.27%	–
2024-09-22	–	–	–	0.27%	–
2024-10-20	–	–	–	0.27%	–
2024-12-22	–	–	–	0.27%	–
2025-01-12	–	–	–	0.27%	–
2025-01-19	–	–	–	0.27%	–
2025-03-09	–	–	–	0.27%	–
2025-03-09	–	–	–	0.27%	–
2025-03-18	–	–	–	–	0.76%
2025-03-30	–	–	–	–	0.76%
2025-04-15	–	–	–	–	0.76%
2025-06-05	–	–	–	–	0.93%
2025-11-18	–	–	–	–	0.93%
2025-11-21	–	–	–	–	0.93%
2025-12-02	–	–	–	–	0.93%
2025-12-03	–	–	–	–	0.93%
2025-12-17	–	–	–	–	1.05%
2026-03-15	–	–	–	–	0.87%
2026-05-31	–	–	–	–	0.78%
2026-06-07	–	–	–	–	0.99%

Tanggal	Persentil
2022-02-06	59%
2022-03-27	6%
2022-04-03	8%
2022-05-29	81%
2022-07-03	81%
2022-12-25	82%
2023-01-01	81%
2023-02-19	82%
2023-03-12	62%
2023-04-02	63%
2023-09-10	64%
2024-02-11	65%
2024-03-24	66%
2024-06-02	66%
2024-07-14	67%
2024-08-04	66%
2024-08-11	67%
2024-09-22	66%
2024-10-20	67%
2024-12-22	65%
2025-01-12	66%
2025-01-19	66%
2025-03-09	67%
2025-03-09	67%
2025-03-18	72%
2025-03-30	71%
2025-04-15	72%
2025-06-05	75%
2025-11-18	74%
2025-11-21	75%
2025-12-02	76%
2025-12-03	75%
2025-12-17	77%
2026-03-15	75%
2026-05-31	74%
2026-06-07	77%

CVE-2012-1979 : Detail

CVE-2012-1979