CRITICAL🇵🇱 Wersja polska

CVE-2017-8898

CVSS 9.8v3.0pub. 2017-05-11upd. 2026-05-13

Invision Power Services (IPS) Community Suite 4.1.19.2 and earlier has stored XSS in the Announcements, allowing privilege escalation from an Invision Power Board moderator to an admin. An attack uses the announce_content parameter in an index.php?/modcp/announcements/&action=create request. This is related to the "<> Source" option.

CVSS Vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

  • Invisioncommunity Invision Power Board

    APP
    Invisioncommunity
    ≤ 4.1.19.2
🔵
CHECK WITH VENDOR
No clear patch data available. Check vendor references.
Tags
XSSLPE
CWE
References

Related vulnerabilities

CVE-2013-3725CRITICAL9.8PL ✓same product

Przejęcie konta admina i RCE w Invision Power Board (IPB) do wersji 3.x

CVE-2012-2226CRITICAL9.8PL ✓same product

Invision Power Board — upload złośliwego pliku umożliwia RCE

CVE-2014-4928HIGH8.8same product

SQL injection vulnerability in Invision Power Board (aka IPB or IP.Board) before 3.4.6 allows remote attackers...

CVE-2017-8899HIGH8.1same product

Invision Power Services (IPS) Community Suite 4.1.19.2 and earlier has a composite of Stored XSS and Informati...

CVE-2016-6174HIGH8.1same product

applications/core/modules/front/system/content.php in Invision Power Services IPS Community Suite (aka Invisio...