HIGH🇵🇱 Wersja polska

CVE-2017-8899

CVSS 8.1v3.0pub. 2017-05-11upd. 2026-05-13

Invision Power Services (IPS) Community Suite 4.1.19.2 and earlier has a composite of Stored XSS and Information Disclosure issues in the attachments feature found in User CP. This can be triggered by any Invision Power Board user and can be used to gain access to moderator/admin accounts. The primary cause is the ability to upload an SVG document with a crafted attribute such an onload; however, full path disclosure is required for exploitation.

CVSS Vector
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

  • Invisioncommunity Invision Power Board

    APP
    Invisioncommunity
    ≤ 4.1.19.2
🔵
CHECK WITH VENDOR
No clear patch data available. Check vendor references.
Tags
XSS
CWE
References

Related vulnerabilities

CVE-2013-3725CRITICAL9.8PL ✓same product

Przejęcie konta admina i RCE w Invision Power Board (IPB) do wersji 3.x

CVE-2012-2226CRITICAL9.8PL ✓same product

Invision Power Board — upload złośliwego pliku umożliwia RCE

CVE-2017-8898CRITICAL9.8PL ✓same product

Stored XSS w Invision Power Board umożliwiający privilege escalation do admina

CVE-2014-4928HIGH8.8same product

SQL injection vulnerability in Invision Power Board (aka IPB or IP.Board) before 3.4.6 allows remote attackers...

CVE-2016-6174HIGH8.1same product

applications/core/modules/front/system/content.php in Invision Power Services IPS Community Suite (aka Invisio...