CVE-2013-4880 : Cross-site scripting (XSS) vulnerability in core/admin/modules/developer/modules

Cross-site scripting (XSS) vulnerability in core/admin/modules/developer/modules/views/add.php in BigTree CMS 4.0 RC2 and earlier allows remote attackers to inject arbitrary web script or HTML via the module parameter.

Published 2013-08-14 13:50:01

Updated 2017-08-29 01:33:41

Source MITRE

View at NVD, CVE.org

Vulnerability category: Cross site scripting (XSS)

Products affected by CVE-2013-4880

Bigtreecms » Bigtree Cms » Update RC2
Versions up to, including, (<=) 4.0
cpe:2.3:a:bigtreecms:bigtree_cms:*:rc2:*:*:*:*:*:*
Matching versions
Bigtreecms » Bigtree Cms » Version: 4.0 Update B4
cpe:2.3:a:bigtreecms:bigtree_cms:4.0:b4:*:*:*:*:*:*
Matching versions
Bigtreecms » Bigtree Cms » Version: 4.0 Update B3
cpe:2.3:a:bigtreecms:bigtree_cms:4.0:b3:*:*:*:*:*:*
Matching versions
Bigtreecms » Bigtree Cms » Version: 4.0 Update RC1
cpe:2.3:a:bigtreecms:bigtree_cms:4.0:rc1:*:*:*:*:*:*
Matching versions
Bigtreecms » Bigtree Cms » Version: 4.0 Update B7
cpe:2.3:a:bigtreecms:bigtree_cms:4.0:b7:*:*:*:*:*:*
Matching versions
Bigtreecms » Bigtree Cms » Version: 4.0 Update B2
cpe:2.3:a:bigtreecms:bigtree_cms:4.0:b2:*:*:*:*:*:*
Matching versions
Bigtreecms » Bigtree Cms » Version: 4.0 Update B1
cpe:2.3:a:bigtreecms:bigtree_cms:4.0:b1:*:*:*:*:*:*
Matching versions
Bigtreecms » Bigtree Cms » Version: 4.0 Update B6
cpe:2.3:a:bigtreecms:bigtree_cms:4.0:b6:*:*:*:*:*:*
Matching versions
Bigtreecms » Bigtree Cms » Version: 4.0 Update B5
cpe:2.3:a:bigtreecms:bigtree_cms:4.0:b5:*:*:*:*:*:*
Matching versions

Exploit prediction scoring system (EPSS) score for CVE-2013-4880

EPSS FAQ

0.26%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 62 %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2013-4880

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source	First Seen
4.3	MEDIUM	AV:N/AC:M/Au:N/C:N/I:P/A:N	8.6	2.9	NIST
Access Vector: Network Access Complexity: Medium Authentication: None Confidentiality Impact: None Integrity Impact: Partial Availability Impact: None

CWE ids for CVE-2013-4880

CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Assigned by: nvd@nist.gov (Primary)

References for CVE-2013-4880

https://www.htbridge.com/advisory/HTB23165

Multiple Vulnerabilities in BigTree CMS - HTB23165 Security Advisory | ImmuniWeb
Exploit

CVEs referencing this url
https://exchange.xforce.ibmcloud.com/vulnerabilities/86287

BigTree CMS index.php cross-site scripting CVE-2013-4880 Vulnerability Report
http://archives.neohapsis.com/archives/bugtraq/2013-08/0039.html

Exploit

CVEs referencing this url
https://github.com/bigtreecms/BigTree-CMS/commit/8a59c2e13f8e151b6a9e98f73e641e1ec8d928df

Fixed a potential cross-site scripting issue on the module view add p… · bigtreecms/BigTree-CMS@8a59c2e · GitHub
Exploit;Patch

Jump to

Vulnerability Details : CVE-2013-4880

Products affected by CVE-2013-4880

Exploit prediction scoring system (EPSS) score for CVE-2013-4880

CVSS scores for CVE-2013-4880

CWE ids for CVE-2013-4880

References for CVE-2013-4880